CVE-2026-85670

Hugging Face's tokenizers library contains an out-of-bounds buffer access (CWE-787) in BpeBuilder::build (tokenizers/src/models/bpe/model.rs): when constructing a BPE model, the builder sizes a scratch buffer to the longest vocabulary key and then writes each concatenated merge rule into it, so any merge whose concatenated tokens exceed that length overruns the buffer. The flaw triggers purely at load time — calling Tokenizer::from_file or Tokenizer::from_str on a crafted tokenizer.json panics without any encoding request — so an attacker who can supply a tokenizer file (user upload, downloaded model config, API input) can abort the host process. A secondary defect in the same code path causes a usize underflow when continuing_subword_prefix is set and a merge token is shorter than the prefix, yielding a panic in debug builds and potential memory corruption in release builds. The impact is denial of service (process abort in Rust and FFI embeddings such as the Python wheels), affecting applications and services that load tokenizer.json from untrusted or attacker-controlled sources; version 0.23.1 is confirmed affected and no fixed version is identified in the available data. There are no known public exploits, PoCs, or CISA KEV entries, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade the tokenizers crate and any FFI/Python wheels to a release that fixes CVE-2026-85670 once upstream publishes the patched version (0.23.1 is confirmed vulnerable). Until patched, only load tokenizer.json from trusted sources; if you must load user-supplied tokenizers, isolate or catch the abort (e.g., catch_unwind or subprocess isolation) and avoid setting continuing_subword_prefix with untrusted merges. Audit whether your service accepts tokenizer files or model configs from untrusted users, as that determines whether this flaw is remotely triggerable for you.