EUVD-2026-60564
GHSA-9x3x-hjpw-2q3f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Victim must actively load the malicious file (UI:R); Rust panic produces only process-level availability impact with no confidentiality or integrity consequence.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convert_gguf_to_hf_tokenizer of the file mistralrs-core/src/gguf/gguf_tokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eos_token_id/bos_token_id/unknown_token_id results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 0.8.23 can resolve this issue. The patch is identified as cd5297e2ea5cb27c790bdcf2f3c2f1064a81d55e. Upgrading the affected component is recommended.
AnalysisAI
Out-of-bounds read in mistral.rs versions 0.8.0 through 0.8.22 allows a remote attacker to crash the GGUF tokenizer by supplying a malformed model file containing out-of-range special token ID values. The convert_gguf_to_hf_tokenizer function in mistralrs-core/src/gguf/gguf_tokenizer.rs uses eos_token_id, bos_token_id, and unknown_token_id values from untrusted GGUF file metadata as direct array indices without validating they fall within vocabulary bounds. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to actively load a maliciously crafted GGUF model file using mistral.rs version 0.8.22 or earlier - this is the UI:P (passive user interaction) gate in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) accurately reflects the bounded impact: the vulnerability is exploitable over the network (AV:N) without attacker privileges (PR:N) and at low attack complexity (AC:L), but requires user interaction to load a malicious GGUF file (UI:P), and produces only a low availability impact (VA:L) with no confidentiality or integrity consequence (VC:N/VI:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a GGUF model file in which the eos_token_id metadata field is set to a value exceeding the vocabulary array length, then publishes it on a public model repository such as Hugging Face under a plausible model name. A mistral.rs user on version 0.8.22 or earlier downloads and loads the file for local inference; during tokenizer initialization, `convert_gguf_to_hf_tokenizer` attempts to index the tokens array at the attacker-supplied offset, triggering a Rust panic and crashing the inference process. … |
| Remediation | Upgrade to mistral.rs version 0.8.23, which is the vendor-confirmed fixed release containing commit cd5297e2ea5cb27c790bdcf2f3c2f1064a81d55e (https://github.com/EricLBuehler/mistral.rs/commit/cd5297e2ea5cb27c790bdcf2f3c2f1064a81d55e). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today