---
id: "CVE-2026-70660"
kind: "vulnerability"
aliases: ["CVE-2026-70660"]
title: "stable-diffusion.cpp: crafted safetensors file can leak memory or crash"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "c++", "diffusion-models", "safetensors", "stable-diffusion.cpp"]
not_affected_if: ["not-using-stable-diffusion-cpp", "trusted-models-only"]
published_at: "2026-11-05T16:17:48+00:00"
first_seen_at: "2026-11-05T16:40:03+00:00"
updated_at: "2026-11-05T16:41:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70660", "first_seen_at": "2026-11-05T16:40:03+00:00"}]
exploit_sources: []
---

# stable-diffusion.cpp: crafted safetensors file can leak memory or crash

stable-diffusion.cpp is a C/C++ library for running image diffusion models such as Stable Diffusion and Flux. A crafted .safetensors model file can declare tensor byte ranges past the end of the file, so loading it can read adjacent process memory into tensor buffers or crash the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project is built from a commit before `master-764-e22272e`.
- Look for stable-diffusion.cpp in your build or dependencies and see which tag or commit it pins.
- Check whether your app loads .safetensors model files from untrusted sources.

## Fix

- stable-diffusion.cpp: move to `master-764-e22272e` or later, per the vendor's patch.

## Timeline

- 2026-11-05T16:40:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-70660

## Documents

- [advisory] Vendor advisory: github.com https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w
- [fix] Patch: github.com https://github.com/leejet/stable-diffusion.cpp/commit/e22272ee631b742dab4440c18eb8fcafb0689402
- [fix] Release notes: github.com https://github.com/leejet/stable-diffusion.cpp/releases/tag/master-764-e22272e

## From the sources

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/model_io/safetensors_io.cpp trusts each tensor's data_offsets after checking only that nbytes equals end - begin. A crafted .safetensors file can declare a byte range beyond the file's data section, causing src/model_loader.cpp to consume an attacker-chosen length from an unchecked mapped-file offset. Loading the model can read adjacent process memory into tensor buffers or crash the process. This issue is fixed in master-764-e22272e.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_