CVE-2026-1260

HighCVSS 7.8/10Last modified Jul 15, 2026

Description

Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Google	Sentencepiece	All versions prior to 0.2.1
Red Hat	Red Hat OpenShift AI 2.25	—
Red Hat	Red Hat OpenShift AI 2.25	—
Red Hat	Red Hat OpenShift AI 2.25	—
Red Hat	Red Hat OpenShift AI 2.25	—
Red Hat	Red Hat OpenShift AI 2.25	—
Red Hat	Red Hat OpenShift AI 3.3	—
Red Hat	Red Hat AI Inference Server	—
Red Hat	Red Hat AI Inference Server	—
Red Hat	Red Hat AI Inference Server	—
Red Hat	Red Hat AI Inference Server	—
Red Hat	Red Hat AI Inference Server	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—

References

Timeline

Published: Jan 22, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-126008.7Denial-of-service (DoS) vulnerability in the internal JPEG2000 (JPX) decoding implementation of the Poppler fork developed by Innodata Labs.CVE-2026-126028.8Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropria CVE-2026-1260296.4The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'act CVE-2026-1260427.0VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${CVE-2026-1260484.6Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c when decoding BER-CVE-2026-1260494.6Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's CVE-2026-126059.6In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-co CVE-2026-1260507.8apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m_compre CVE-2026-1260517.5A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the se CVE-2026-126065.3Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leverag CVE-2026-1260614.3Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount co CVE-2026-1260623.7Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrus