Out-of-bounds write in XGrammar - #VU162999
Published: November 9, 2026
Vulnerability identifier: #VU162999
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unprivileged local attacker to cause memory corruption and terminate an application using XGrammar, resulting in denial of service.
The vulnerability exists due to missing range validation for grammar.allow_empty_rule_ids during compiled-grammar deserialization, allowing invalid rule IDs to trigger an out-of-bounds write during matcher construction. An unprivileged local attacker can supply a crafted compiled-grammar cache and induce a user to load it into an application that restores the cache and constructs a matcher.
Affected software
XGrammar
Remediation
Install security update from vendor's website.
XGrammar - update to 0.2.6