CVE-2026-75090: Mistral.rs Buffer Overflow Vulnerability

CVE-2026-75090 Overview

CVE-2026-75090 is an out-of-bounds read vulnerability [CWE-119] in EricLBuehler Mistral.rs through version 0.8.22. The flaw resides in the convert_gguf_to_hf_tokenizer function within mistralrs-core/src/gguf/gguf_tokenizer.rs, part of the GGUF Tokenizer component. An attacker can manipulate the eos_token_id, bos_token_id, or unknown_token_id arguments supplied through untrusted GGUF metadata to trigger an out-of-bounds read. The exploit has been publicly disclosed. Upgrading to version 0.8.23 resolves the issue via commit cd5297e2ea5cb27c790bdcf2f3c2f1064a81d55e.

Critical Impact
A malformed GGUF model file can cause Mistral.rs to panic when loading, leading to a denial-of-service condition against inference services that ingest untrusted model files.

Affected Products

EricLBuehler Mistral.rs versions up to and including 0.8.22
Component: GGUF Tokenizer (mistralrs-core/src/gguf/gguf_tokenizer.rs)
Fixed in EricLBuehler Mistral.rs version 0.8.23

Discovery Timeline

2026-08-18 - CVE-2026-75090 published to NVD
2026-08-20 - Last updated in NVD database
Patch commit cd5297e2ea5cb27c790bdcf2f3c2f1064a81d55e merged via GitHub Pull Request #2282 and released in v0.8.23

Technical Details for CVE-2026-75090

Vulnerability Analysis

Mistral.rs is a Rust-based large language model inference engine. It supports the GGUF file format for loading quantized models. The GGUF file contains metadata fields including special token identifiers used by the tokenizer. The convert_gguf_to_hf_tokenizer function reads these token IDs and uses them to index into the vocabulary token array.

The pre-patch implementation does not validate that the token IDs fall within the bounds of the vocabulary. When an attacker supplies a crafted GGUF file with an eos_token_id, bos_token_id, or unknown_token_id exceeding the vocabulary size, indexing operations trigger an out-of-bounds read and a Rust panic. This causes the inference process to terminate.

Root Cause

The root cause is missing input validation on trust-boundary data. Special token IDs originate from GGUF metadata, which is untrusted user-controllable input. The tokenizer conversion routine indexes the tokens slice with these IDs without first ensuring id < vocab_size. This violates safe indexing guarantees and matches the classic [CWE-119] pattern of improper restriction of operations within memory buffer bounds.

Attack Vector

An attacker delivers a malicious GGUF model file to a system running Mistral.rs. Exploitation requires user interaction to load the crafted model. When the tokenizer conversion runs, the out-of-range token ID triggers a panic in the Rust runtime, crashing the inference service. The vulnerability does not permit code execution or information disclosure beyond process termination.

rust

            bos: c.get_value("bos_token_id").ok(),
         };
 
+        // Special token ids come from untrusted GGUF metadata; reject out-of-range ids
+        // so a malformed file errors instead of panicking when indexing `tokens`.
+        let vocab_size = props.tokens.len();
+        let check = |name: &str, id: u32| -> Result<()> {
+            anyhow::ensure!(
+                (id as usize) < vocab_size,
+                "GGUF `{name}` token id {id} is out of bounds for vocab size {vocab_size}"
+            );
+            Ok(())
+        };
+        check("eos", props.eos)?;
+        if let Some(bos) = props.bos {
+            check("bos", bos)?;
+        }
+        if let Some(unk) = props.unk {
+            check("unk", unk)?;
+        }
+
         Ok(props)
     }
 }
// Source: https://github.com/EricLBuehler/mistral.rs/commit/cd5297e2ea5cb27c790bdcf2f3c2f1064a81d55e

The patch introduces a check closure that validates each special token ID against vocab_size and returns a descriptive error instead of panicking on out-of-range indices.

Detection Methods for CVE-2026-75090

Indicators of Compromise

Unexpected process termination or Rust panic messages referencing gguf_tokenizer.rs in Mistral.rs logs
Repeated crash-loop restarts of Mistral.rs inference services shortly after loading a new model file
GGUF files sourced from untrusted repositories or user uploads containing anomalous eos_token_id, bos_token_id, or unknown_token_id metadata values

Detection Strategies

Inspect GGUF metadata prior to load and flag files where special token IDs exceed the declared vocabulary size
Monitor Mistral.rs stderr and application logs for panic traces originating from mistralrs-core/src/gguf/
Compare installed Mistral.rs versions against the fixed release 0.8.23 in software inventory data

Monitoring Recommendations

Alert on abnormal termination of processes hosting Mistral.rs inference workloads
Track ingestion of externally sourced GGUF files and correlate with process crashes within a short time window
Log and review model-loading events, capturing file hash, source, and requesting user

How to Mitigate CVE-2026-75090

Immediate Actions Required

Upgrade Mistral.rs to version 0.8.23 or later on all affected systems
Audit existing GGUF model files for anomalous special token IDs and remove untrusted files from model directories
Restrict model upload and loading capabilities to authenticated, authorized users only

Patch Information

The fix is available in Mistral.rs v0.8.23 and delivered via commit cd5297e2ea5cb27c790bdcf2f3c2f1064a81d55e. See GitHub Issue #2225 and Pull Request #2282 for additional technical context.

Workarounds

Only load GGUF model files from trusted, verified sources
Validate special token IDs against vocabulary size before submitting models to Mistral.rs
Run inference workers under process supervisors that isolate crashes and prevent cascading service failures

bash

# Configuration example: upgrade Mistral.rs via cargo
cargo install --locked --version 0.8.23 mistralrs-server

# Verify installed version
mistralrs-server --version