Mistral.rs CVE-2026-75090

Exploitation requires the victim to actively load a maliciously crafted GGUF model file using mistral.rs version 0.8.22 or earlier - this is the UI:P (passive user interaction) gate in the CVSS 4.0 vector. The specific triggering condition is a GGUF file metadata entry for eos_token_id, bos_token_id, or unknown_token_id whose integer value is greater than or equal to the length of the tokens vocabulary array in the same file. No authentication, elevated privileges, or special server-side configuration is required from the attacker. Exploitation is bounded by the requirement that the victim must be persuaded or deceived into loading the malicious file; there is no indication in the available data that mistral.rs exposes a remotely triggerable endpoint that automatically loads GGUF files without user action, so automated unauthenticated network exploitation against a passive service is not supported by the evidence.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects the bounded impact: the vulnerability is exploitable over the network (AV:N) without attacker privileges (PR:N) and at low attack complexity (AC:L), but requires user interaction to load a malicious GGUF file (UI:P), and produces only a low availability impact (VA:L) with no confidentiality or integrity consequence (VC:N/VI:N). Rust's memory safety model converts the out-of-bounds read into a controlled panic rather than exploitable memory disclosure, eliminating the information-disclosure risk the 'Buffer Overflow, Information Disclosure' tags might imply - the confidentiality impact assessed in the provided CVSS vector (VC:N) is therefore consistent with the runtime behavior. A publicly available exploit (E:P) increases the practical likelihood of targeted disruption, and even a mid-sized ML engineering team in inowroclaw running mistral.rs as an internal inference service should prioritize the 0.8.23 upgrade rather than defer it. However, the absence of a CISA KEV listing and the UI:P gate mean mass automated exploitation is not plausible; the realistic threat is a malicious model file distributed via a public repository to induce crashes in downstream users. EPSS data was not provided, so exploitation probability cannot be quantified beyond the E:P signal.

An attacker crafts a GGUF model file in which the eos_token_id metadata field is set to a value exceeding the vocabulary array length, then publishes it on a public model repository such as Hugging Face under a plausible model name. A mistral.rs user on version 0.8.22 or earlier downloads and loads the file for local inference; during tokenizer initialization, convert_gguf_to_hf_tokenizer attempts to index the tokens array at the attacker-supplied offset, triggering a Rust panic and crashing the inference process. A publicly available proof-of-concept is referenced via GitHub issue #2225, confirming the attack is reproducible with low effort.