High severityOSV Advisory· Published Jan 22, 2026· Updated Jan 22, 2026

Invalid Memory Access in Sentencepiece,

CVE-2026-1260

Description

Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
sentencepiecePyPI	< 0.2.1	0.2.1

Affected products

Google/SentencepieceOSV
Range: 0.2.1pre1, v0.1.4, v0.1.5, …
osv-coords2 versions
pkg:apk/chainguard/py3.11-text-generation-inference pkg:pypi/sentencepiece
< 3.3.7-r6+ 1 more
- (no CPE)range: < 3.3.7-r6
- (no CPE)range: < 0.2.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-38vq-g6vr-w8wfghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-1260ghsaADVISORY
github.com/google/sentencepiece/commit/d856b67fdb3492e035489abf9b3aaf486144b2c0ghsaWEB
github.com/google/sentencepiece/releases/tag/v0.2.1ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000