CVE-2026-85670: Out-of-bounds Write in huggingface tokenizers

The vulnerability in Hugging Face tokenizers (version 0.23.1) arises from an out-of-bounds buffer access in BpeBuilder::build during tokenizer.json loading. The scratch buffer is sized to the longest vocabulary key, but a merge rule with a concatenated token longer than this key causes a buffer overflow, leading to a Rust panic that aborts the process. Additionally, if the continuing_subword_prefix option is enabled and a merge token is shorter than this prefix, a usize underflow can occur, causing a panic in debug mode and potential memory corruption in release mode. This vulnerability can be exploited by supplying a malicious tokenizer.json file, resulting in denial of service at load time without requiring token encoding.

An attacker who can supply a crafted tokenizer.json file can cause the tokenizers process to panic and abort, resulting in a denial of service. The secondary defect may lead to memory corruption in release builds, potentially causing undefined behavior or crashes. There is no indication of code execution or data leakage. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid loading untrusted or unauthenticated tokenizer.json files to prevent denial of service. Monitor official Hugging Face channels for updates or patches addressing this vulnerability.