CVE-2026-85670: tokenizers BpeBuilder Buffer Overflow via merge token

Vulnerability summary

CVE-2026-85670 is a high (CVSS 7.1) Out-of-bounds Write vulnerability in huggingface tokenizers. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 40.5% of scored vulnerabilities.

Timeline

1. 04-09-2026
   PublishedVulnerability first disclosed.
2. 04-09-2026
   Last modifiedVulnerability information updated.

Description

tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBuilder::build (tokenizers/src/models/bpe/model.rs). When loading a tokenizer.json via Tokenizer::from_file/from_str, the builder sizes a scratch buffer to the longest vocabulary key, then writes each concatenated merge rule into it. A merge whose concatenated token exceeds the longest vocabulary key overruns the buffer, which Rust turns into a panic that aborts the process in Rust and FFI embeddings. This occurs at load time with no encoding required, so an attacker who supplies a crafted tokenizer.json can cause a denial of service. A secondary defect at the same location can cause a usize underflow (panic in debug, potential memory corruption in release) when continuing_subword_prefix is set and a merge token is shorter than the prefix. Observed in version 0.23.1.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.