---
id: "CVE-2026-111985"
kind: "vulnerability"
aliases: ["CVE-2026-111985"]
title: "stable-diffusion-webui: crafted safetensors header exhausts memory during metadata read"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "stable-diffusion-webui", "fixed": [], "affected": ">= 1.10.0, <= 1.10.1", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-tooling", "image-generation", "self-hosted", "stable-diffusion-webui"]
not_affected_if: ["no-untrusted-model-uploads", "not-exposed-to-network", "trusted-models-only"]
published_at: "2026-10-18T12:17:11+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:32:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111985", "first_seen_at": "2026-10-23T21:57:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T04:32:08+00:00"}]
---

# stable-diffusion-webui: crafted safetensors header exhausts memory during metadata read

AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 does not validate the header length field when reading safetensors model metadata in modules/sd_models.py. A remote attacker can supply a crafted model file that makes the server allocate excessive resources.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:stable-diffusion-webui affected >= 1.10.0, <= 1.10.1 fixed ?

## How to check

- Version: git -C stable-diffusion-webui describe --tags (1.10.0 and 1.10.1 listed affected; no fixed release exists)
- Sink: grep -n "file.read(metadata_len-2)" modules/sd_models.py
- Look in models/Stable-diffusion (and Lora/embeddings dirs) for unknown .safetensors files; startup log shows '*** Error reading metadata from file' with MemoryError if hit
- Check if UI/API is exposed (--listen, --share) and whether users can upload models

## Fix

No fixed version or patch upstream as of 2026-10-25. Interim: only load safetensors from trusted sources; reporter suggests bounding metadata_len by the file size (os.fstat(file.fileno()).st_size) before file.read in modules/sd_models.py, or using the safetensors library for metadata.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111985
- 2026-10-25T04:32:08+00:00 analyst — NVD + upstream issue #17498 (open, no maintainer reply, no fix; 1.10.1 is latest release, bug also on master per reporter). PoC public (poc.zip attached to issue). Impact low: oversized read raises MemoryError, caught; process survives; needs a crafted file already in models/Stable-diffusion. Not exploited per sources.

## Documents

- [advisory] NVD record CVE-2026-111985 https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-111985
- [mentions] stable-diffusion-webui releases (latest 1.10.1) https://github.com/AUTOMATIC1111/stable-diffusion-webui/releases
- [poc] [Bug]: safetensors header length used unchecked in file.read() (#17498) https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17498

## From the sources

A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_