Vulnerability · Published Jan 22, 2026 · Assigned by Google
CVE-2026-1260Invalid Memory Access in Sentencepiece,
High 7.8
In plain English
A high-severity memory corruption in Sentencepiece from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 93.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | sentencepiece | 0.2.1 | GHSA-38vq-g6vr-w8wf |
| PyPI | sentencepiece | 0.2.1 | PYSEC-2026-1909 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sentencepiece | All versions prior to 0.2.1 |
Weakness: CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/google/sentencepiece/releases/tag/v0.2.1
- https://access.redhat.com/security/cve/CVE-2026-1260 vdb-entry, x_refsource_REDHAT
- RHBZ#2432079 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1260.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:3782 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3713 vendor-advisory, x_refsource_REDHAT