The vulnerability resides in the convert_gguf_to_hf_tokenizer function of Mistral.rs's GGUF Tokenizer component. By supplying crafted values for eos_token_id, bos_token_id, or unknown_token_id, an attacker can trigger an out-of-bounds read, allowing the disclosure of memory contents. The flaw can be exercised remotely through the tokenizer conversion interface, but it does not grant code execution. The primary consequence is the potential leakage of sensitive data stored in the process address space.

All publicly available releases of EricLBuehler Mistral.rs up to and including version 0.8.22 are affected. Version 0.8.23 includes the fix that prevents the out-of-bounds read by validating token identifiers before use.

The CVSS score of 5.3 indicates moderate risk, while no EPSS data is available and the issue is not listed in CISA's KEV catalog. The exploit is publicly known, and the vulnerability can be triggered remotely, making it a valid attack vector for a remote adversary. The absence of an immediate denial of service or code execution does not diminish the risk of data exposure stemming from the memory read.