Description

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convert_gguf_to_hf_tokenizer of the file mistralrs-core/src/gguf/gguf_tokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eos_token_id/bos_token_id/unknown_token_id results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 0.8.23 can resolve this issue. The patch is identified as cd5297e2ea5cb27c790bdcf2f3c2f1064a81d55e. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T02:17:30.333Z",
  "pubdate": "2026-08-18T02:17:30.333Z",
  "executiveSummary": "An out-of-bounds read vulnerability has been identified in EricLBuehler Mistral.rs up to version 0.8.22, specifically within the GGUF Tokenizer component. The vulnerability is triggered by improper manipulation of token identifier arguments, namely eos_token_id, bos_token_id, and unknown_token_id, during the parsing and conversion processes. Successful exploitation of this flaw can lead to an out-of-bounds read condition, potentially exposing sensitive memory contents or causing application instability. The vulnerability affects the mistralrs-core/src/gguf/gguf_tokenizer.rs file, specifically within the convert_gguf_to_hf_tokenizer function. The attack vector is remote, and the exploit has been made public, significantly elevating the risk profile for deployed instances. Exploitation requires an adversary to supply a maliciously crafted input or configuration designed to manipulate token identifier parameters improperly. Organizations utilizing the affected software face potential data disclosure risks if robust input validation or version controls are absent.",
  "technicalDetails": "The vulnerability resides in the convert_gguf_to_hf_tokenizer function located within the mistralrs-core/src/gguf/gguf_tokenizer.rs file of the GGUF Tokenizer component in EricLBuehler Mistral.rs up to version 0.8.22. The root cause of the flaw stems from insufficient boundary checking and validation when processing token identifier arguments such as eos_token_id, bos_token_id, and unknown_token_id supplied via GGUF format data structures. When these parameters are parsed and mapped to Hugging Face tokenizer structures, lack of strict index verification allows an attacker to specify out-of-range or malformed integer values.\nDuring the execution of convert_gguf_to_hf_tokenizer, the application attempts to access internal arrays, token tables, or vector structures using the supplied token identifiers as direct offsets or indices. Because the input arguments eos_token_id, bos_token_id, and unknown_token_id are not adequately bounded against the actual dimensions of the target memory buffers, supplying crafted values forces the parsing logic to read memory addresses outside the legitimate boundaries of the allocated buffers. This results in an out-of-bounds read condition.\nThe attack flow initiates remotely when an unauthenticated attacker provides a specially crafted GGUF file or payload containing malicious token identifier configurations to an exposed instance of Mistral.rs parsing untrusted models. As the application processes the input through the vulnerable function, the malicious parameters are evaluated without validation. The memory read operation accesses adjacent heap or stack memory spaces depending on the memory layout. Depending on what resides adjacent to the buffer, this can leak internal application state, heap data, or sensitive pointers back to the caller or cause a segmentation fault leading to a denial of service.\nThe vulnerability is exposed across network boundaries wherever Mistral.rs handles remote model loading or processes untrusted GGUF files without prior sanitization. No special privileges or authentication are inherently required if the parsing endpoint accepts remote inputs or user-supplied model files directly."
}