CVE-2026-1260
Published: 22 January 2026
Summary
CVE-2026-1260 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Google Sentencepiece. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 3.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as NLP and Transformers; in the Adversarial Attacks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-1260 is an invalid memory access vulnerability affecting Sentencepiece versions prior to 0.2.1. The issue arises when processing a vulnerable model file, which is not generated through the standard training procedure. Classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), it carries a CVSS v3.1 base score of 7.8, indicating high severity due to potential impacts on confidentiality, integrity, and availability.
A local attacker with low privileges can exploit this vulnerability by supplying a malicious model file to a Sentencepiece instance running with those privileges. The low attack complexity and lack of required user interaction enable reliable exploitation, potentially leading to arbitrary code execution, data corruption, or denial of service through memory corruption.
The official mitigation, as detailed in the Sentencepiece release notes at https://github.com/google/sentencepiece/releases/tag/v0.2.1, involves upgrading to version 0.2.1 or later, which addresses the invalid memory access flaw. Security practitioners should validate and sanitize model files from untrusted sources prior to processing.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3802
Vulnerability details
Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.
- CWE(s)
AI Security AnalysisAI
- AI Category
- NLP and Transformers
- Risk Domain
- Adversarial Attacks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: sentencepiece
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local exploitation of memory corruption in Sentencepiece via malicious model file enables arbitrary code execution without user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring timely flaw remediation, such as upgrading Sentencepiece to version 0.2.1 or later.
Addresses exploitation via malicious model files by enforcing validation and sanitization of inputs from untrusted sources before processing.
Implements memory protection mechanisms that prevent unauthorized code execution and corruption from invalid memory accesses like buffer overflows.