CVE-2026-25048 — Vulnetix

CVE-2026-25048 PUBLISHED CVSS 8.699999809265137 HIGH

xgrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.32, the multi-level nested syntax caused a segmentation fault (core dumped). This issue has been patched in version 0.1.32.

EPSS 0.08% · 23.9th percentile

Risk Scores

CVSS 4.0

8.699999809265137

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.08%

23.9th percentile

Affected Products

Vendor	Product	Versions
mlc-ai	xgrammar	< 0.1.32, 0, < 0.1.32
PyPI	xgrammar	0, 0, 0

Exploit Intelligence

CIRCL seen: CVE-2026-25048 (circl-sighting)
https://github.com/mlc-ai/xgrammar/releases/tag/v0.1.32 (circl)
https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3 (nist-nvd)

Timeline

Mar 5, 2026 CVE Published
Mar 5, 2026 PoC Published
Mar 6, 2026 EPSS Score
Mar 7, 2026 EPSS Score
Mar 8, 2026 EPSS Score
Mar 9, 2026 Security Advisory
Mar 10, 2026 EPSS Score
Mar 11, 2026 EPSS Score
Mar 12, 2026 EPSS Score
Mar 13, 2026 EPSS Score
Mar 14, 2026 EPSS Score
Mar 16, 2026 EPSS Score

References

Open in Interactive Console →