{"id":"CVE-2026-70660","kind":"vulnerability","aliases":["CVE-2026-70660"],"related":[],"title":"stable-diffusion.cpp: crafted safetensors file can leak memory or crash","description":"stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/model_io/safetensors_io.cpp trusts each tensor's data_offsets after checking only that nbytes equals end - begin. A crafted .safetensors file can declare a byte range beyond the file's data section, causing src/model_loader.cpp to consume an attacker-chosen length from an unchecked mapped-file offset. Loading the model can read adjacent process memory into tensor buffers or crash the process. This issue is fixed in master-764-e22272e.","summary":"stable-diffusion.cpp is a C/C++ library for running image diffusion models such as Stable Diffusion and Flux. A crafted .safetensors model file can declare tensor byte ranges past the end of the file, so loading it can read adjacent process memory into tensor buffers or crash the process.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","c++","diffusion-models","safetensors","stable-diffusion.cpp"],"not_affected_if":["not-using-stable-diffusion-cpp","trusted-models-only"],"how_to_check":"- Check whether the project is built from a commit before `master-764-e22272e`.\n- Look for stable-diffusion.cpp in your build or dependencies and see which tag or commit it pins.\n- Check whether your app loads .safetensors model files from untrusted sources.","fix":"- stable-diffusion.cpp: move to `master-764-e22272e` or later, per the vendor's patch.","status":"open","published_at":"2026-11-05T16:17:48+00:00","first_seen_at":"2026-11-05T16:40:03+00:00","triaged_at":"2026-11-05T16:41:39+00:00","updated_at":"2026-11-05T16:41:39+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-05T16:41:39Z","model":"claude-haiku-5-5","output":{"fix":"- stable-diffusion.cpp: move to `master-764-e22272e` or later, per the vendor's patch.","reach":"local","title":"stable-diffusion.cpp: crafted safetensors file can leak memory or crash","impact":"medium","summary":"stable-diffusion.cpp is a C/C++ library for running image diffusion models such as Stable Diffusion and Flux. A crafted .safetensors model file can declare tensor byte ranges past the end of the file, so loading it can read adjacent process memory into tensor buffers or crash the process.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["stable-diffusion.cpp","diffusion-models","safetensors","c++"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Process memory is read into tensor buffers, or the process crashes","analyst_note":"","how_to_check":"- Check whether the project is built from a commit before `master-764-e22272e`.\n- Look for stable-diffusion.cpp in your build or dependencies and see which tag or commit it pins.\n- Check whether your app loads .safetensors model files from untrusted sources.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-models-only","not-using-stable-diffusion-cpp"],"who_is_affected":"Applications that embed stable-diffusion.cpp and load .safetensors model files, especially files from outside sources. Systems that only load models you built or vetted yourself are much less exposed. Teams using a different inference stack can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000734,"input_tokens":4423,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-70660':12A,15A '-764':97C,170C 'adjac':62B,154C 'ai':17B 'ai-tool':16B 'attack':139C 'attacker-chosen':138C 'begin':117C 'beyond':127C 'buffer':67B,159C 'byte':49B,125C 'c':19B 'c/c':28B,76C 'caus':133C 'check':111C 'chosen':140C 'consum':136C 'craft':2A,42B,119C 'crash':9A,69B,161C 'cve':10A,13A 'data':108C,131C 'declar':47B,123C 'diffus':21B,33B,38B,80C,83C 'diffusion-model':20B 'e22272e':98C,171C 'end':53B,116C 'equal':115C 'file':4A,45B,56B,121C,129C,147C 'fix':167C 'flux':40B,84C 'imag':32B,87C,90C 'infer':93C 'issu':165C 'leak':6A 'length':141C 'librari':29B,77C 'load':58B,149C 'loader':101C 'map':146C 'mapped-fil':145C 'master':96C,169C 'memori':7A,64B,156C 'model':22B,34B,44B,81C,151C 'nbyte':114C 'offset':109C,148C 'past':51B 'prior':94C 'process':63B,71B,155C,163C 'pure':75C 'qwen':86C 'rang':50B,126C 'read':61B,153C 'run':31B,79C 'safetensor':3A,23B,43B,100C,120C 'section':132C 'src/model_io/safetensors_io.cpp':103C 'src/model_loader.cpp':134C 'stabl':37B,82C 'stable-diffusion.cpp':1A,24B,25B,72C 'tensor':48B,66B,106C,158C 'tool':18B 'trust':104C 'uncheck':144C 'wan':85C 'z':89C 'z-imag':88C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed stable-diffusion.cpp and load .safetensors model files, especially files from outside sources. Systems that only load models you built or vetted yourself are much less exposed. Teams using a different inference stack can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","c","diffusionmodels","medium","safetensors","stablediffusioncpp"],"campaign_type":null,"first_public_at":"2026-09-27T13:47:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-70660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70660","severity":null,"published_at":"2026-11-05T16:17:48+00:00","modified_at":"2026-11-05T16:17:48+00:00","first_seen_at":"2026-11-05T16:40:03+00:00","fetched_at":"2026-11-05T16:40:03+00:00","note":null}],"documents":[{"id":77658,"url":"https://github.com/leejet/stable-diffusion.cpp/commit/e22272ee631b742dab4440c18eb8fcafb0689402","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":77659,"url":"https://github.com/leejet/stable-diffusion.cpp/releases/tag/master-764-e22272e","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":77660,"url":"https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-27T13:47:15+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}