# CVE-2026-85670: Hugging Face tokenizers buffer overflow in BpeBuilder

Source: https://junglewise.ai/threats/cve-2026-85670-hugging-face-tokenizers-buffer-overflow-in-bpebuilder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85670 · Severity: medium · CVSS 6.5 · Published 2026-09-04

Hugging Face tokenizers is a library that performs text tokenization for machine learning models. A malicious tokenizer.json configuration file can trigger a buffer overflow when loaded, causing the application to crash immediately—even before any text is processed. An attacker could exploit this to cause denial of service in any service that loads untrusted tokenizer configurations.

Vendors: [Hugging Face](https://junglewise.ai/threats/vendors/hugging-face).

## Quick answers

**Is CVE-2026-85670 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85670 being exploited in the wild.

**How severe is CVE-2026-85670?** Medium severity, with a CVSS score of 6.5, published 4 September 2026.

**Which products and versions are affected?** Hugging Face Tokenizers 0.23.1.

**Is there a fix for CVE-2026-85670?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85670 attacked?** It is attacked over the network or from the adjacent network or with local access, in a software library.

**Am I affected by CVE-2026-85670?** Check whether you run Hugging Face Tokenizers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an out-of-bounds buffer access in BpeBuilder::build (tokenizers/src/models/bpe/model.rs) that occurs during tokenizer deserialization. When loading a tokenizer.json file, the code allocates a scratch buffer sized to the longest vocabulary key, then writes merge rules into it. If a merge rule's concatenated token exceeds the longest vocabulary key size, the write overruns the buffer, triggering a Rust panic that aborts the process. Attack vector is local/adjacent through crafted tokenizer.json files; no authentication or encoding operations are required. A secondary defect can cause usize underflow when continuing_subword_prefix is configured and a merge token is shorter than the prefix. Observed in version 0.23.1; patch availability in later versions is indicated by references to v0.23.2.

## Affected products

- Hugging Face tokenizers 0.23.1

## Timeline

- 2026-09-04: disclosed

## References

- [https://github.com/huggingface/tokenizers](https://github.com/huggingface/tokenizers)
- [https://github.com/huggingface/tokenizers/blob/v0.23.2/tokenizers/src/models/bpe/model.rs](https://github.com/huggingface/tokenizers/blob/v0.23.2/tokenizers/src/models/bpe/model.rs)