CVE-2026-75090

Name of the Vulnerable Software and Affected Versions EricLBuehler Mistral.rs versions prior to 0.8.23

Description A remote out-of-bounds read can occur within the GGUF Tokenizer component. The issue exists in the convert gguf to hf tokenizer() function located in the mistralrs-core/src/gguf/gguf tokenizer.rs file. This occurs when the eos token id, bos token id, or unknown token id arguments are manipulated.

Recommendations Update to version 0.8.23.