{"id":"CVE-2026-111985","kind":"vulnerability","aliases":["CVE-2026-111985"],"related":[],"title":"stable-diffusion-webui: crafted safetensors header exhausts memory during metadata read","description":"A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 does not validate the header length field when reading safetensors model metadata in modules/sd_models.py. A remote attacker can supply a crafted model file that makes the server allocate excessive resources.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"stable-diffusion-webui","fixed":[],"affected":">= 1.10.0, <= 1.10.1","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","image-generation","self-hosted","stable-diffusion-webui"],"not_affected_if":["no-untrusted-model-uploads","not-exposed-to-network","trusted-models-only"],"how_to_check":"- Version: git -C stable-diffusion-webui describe --tags (1.10.0 and 1.10.1 listed affected; no fixed release exists)\n- Sink: grep -n \"file.read(metadata_len-2)\" modules/sd_models.py\n- Look in models/Stable-diffusion (and Lora/embeddings dirs) for unknown .safetensors files; startup log shows '*** Error reading metadata from file' with MemoryError if hit\n- Check if UI/API is exposed (--listen, --share) and whether users can upload models","fix":"No fixed version or patch upstream as of 2026-10-25. Interim: only load safetensors from trusted sources; reporter suggests bounding metadata_len by the file size (os.fstat(file.fileno()).st_size) before file.read in modules/sd_models.py, or using the safetensors library for metadata.","status":"open","published_at":"2026-10-18T12:17:11+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:30:56+00:00","updated_at":"2026-10-25T04:32:08+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T04:30:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"stable-diffusion-webui: crafted safetensors header exhausts memory during metadata read","impact":"low","summary":"AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 does not validate the header length field when reading safetensors model metadata in modules/sd_models.py. A remote attacker can supply a crafted model file that makes the server allocate excessive resources.","category":"ai-tooling","nicknames":[],"who_cares":["stable-diffusion-webui","self-hosted","image-generation"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server memory exhaustion, causing denial of service","analyst_note":"Find out whether a fixed version or a patch exists upstream, since the project has not responded, and check the NVD entry for the exploit reference.","how_to_check":"- Check the installed version with `git -C stable-diffusion-webui describe --tags` and compare it to `1.10.1`\n- Check whether the web UI is reachable from untrusted networks, for example by looking at the `--listen` flag in the launch arguments","needs_analyst":true,"not_affected_if":["not-exposed-to-network","no-untrusted-model-uploads"],"who_is_affected":"Teams that run AUTOMATIC1111 stable-diffusion-webui at version 1.10.1 or earlier, especially if the instance accepts model files or metadata from users or the network. The sources do not say whether a fixed version exists or whether the project has responded. Instances that are not reachable from outside a trusted network are less exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000629,"input_tokens":3370,"output_tokens":584,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Find out whether a fixed version or a patch exists upstream, since the project has not responded, and check the NVD entry for the exploit reference.","search":"'-111985':15A,18A '-2026':14A,17A '1.10.1':43B,86C 'ai':24B 'ai-tool':23B 'alloc':71B,114C 'argument':108C 'attack':60B,123C 'automatic1111':36B,79C 'compon':101C 'could':132C 'craft':5A,64B 'cve':13A,16A 'diffus':3A,34B,39B,82C 'diffusion':21A 'earli':142C 'excess':72B 'exhaust':8A 'exploit':126C 'extract':103C 'field':50B,111C 'file':66B,97C 'found':77C 'function':90C 'generat':28B 'header':7A,48B,109C 'host':31B 'imag':27B 'image-gener':26B 'impact':88C 'inform':138C 'issu':145C 'launch':121C 'length':49B,110C 'made':129C 'make':68B 'manipul':105C 'memori':9A 'metadata':11A,55B,92C,102C 'model':54B,65B 'modules/sd_models.py':57B,98C 'possibl':119C 'problem':141C 'project':136C 'public':130C 'read':12A,52B,91C 'remot':59B,124C 'report':146C 'resourc':73B,116C 'respond':150C 'result':112C 'safetensor':6A,53B,94C 'self':30B 'self-host':29B 'server':70B 'stabl':2A,33B,38B,81C 'stable':20A 'stable-diffusion-webui':1A,19A,32B,37B,80C 'suppli':62B 'tool':25B 'use':134C 'valid':46B 'vulner':75C 'webui':4A,22A,35B,40B,83C 'yet':151C","nicknames":[],"mitigations":[],"who_affected":"Teams that run AUTOMATIC1111 stable-diffusion-webui at version 1.10.1 or earlier, especially if the instance accepts model files or metadata from users or the network. The sources do not say whether a fixed version exists or whether the project has responded. Instances that are not reachable from outside a trusted network are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-111985","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111985","severity":null,"published_at":"2026-10-18T12:17:11+00:00","modified_at":"2026-10-19T19:17:24+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111985:814","url":null,"severity":null,"published_at":"2026-10-25T04:32:08+00:00","modified_at":"2026-10-25T04:32:08+00:00","first_seen_at":"2026-10-25T04:32:08+00:00","fetched_at":"2026-10-25T04:32:08+00:00","note":"NVD + upstream issue #17498 (open, no maintainer reply, no fix; 1.10.1 is latest release, bug also on master per reporter). PoC public (poc.zip attached to issue). Impact low: oversized read raises MemoryError, caught; process survives; needs a crafted file already in models/Stable-diffusion. Not exploited per sources."}],"documents":[{"id":3396,"url":"https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17498","title":"[Bug]: safetensors header length used unchecked in file.read() (#17498)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3398,"url":"https://github.com/AUTOMATIC1111/stable-diffusion-webui/releases","title":"stable-diffusion-webui releases (latest 1.10.1)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":3400,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-111985","title":"NVD record CVE-2026-111985","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}