Mistral Rs
Monthly
Out-of-bounds read in mistral.rs versions 0.8.0 through 0.8.22 allows a remote attacker to crash the GGUF tokenizer by supplying a malformed model file containing out-of-range special token ID values. The `convert_gguf_to_hf_tokenizer` function in `mistralrs-core/src/gguf/gguf_tokenizer.rs` uses eos_token_id, bos_token_id, and unknown_token_id values from untrusted GGUF file metadata as direct array indices without validating they fall within vocabulary bounds. Publicly available exploit code exists, vendor-released patch version 0.8.23 is confirmed, and no CISA KEV listing is present at time of analysis.
Out-of-bounds read in mistral.rs versions 0.8.0 through 0.8.22 allows a remote attacker to crash the GGUF tokenizer by supplying a malformed model file containing out-of-range special token ID values. The `convert_gguf_to_hf_tokenizer` function in `mistralrs-core/src/gguf/gguf_tokenizer.rs` uses eos_token_id, bos_token_id, and unknown_token_id values from untrusted GGUF file metadata as direct array indices without validating they fall within vocabulary bounds. Publicly available exploit code exists, vendor-released patch version 0.8.23 is confirmed, and no CISA KEV listing is present at time of analysis.