CVE-2026-111985 in stable-diffusion-webui
Summary
by MITRE • 10/18/2026
A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified within AUTOMATIC1111 stable-diffusion-webui, specifically affecting versions up to 1.10.1, resides in the metadata extraction component responsible for processing safetensors model files. The core technical flaw is located in the read_metadata_from_safetensors function found in the modules/sd_models.py file. This function handles the parsing of header information from safetensor format models, which are commonly used to store weights and configurations for deep learning models such as Stable Diffusion. The specific defect involves improper validation or handling of the argument related to the header length field during the deserialization process. When a maliciously crafted safetensors file is processed, the manipulation of this header length parameter leads to an incorrect calculation of memory requirements or buffer sizes required to store the extracted metadata.
This miscalculation results in an improper allocation of resources on the server hosting the web UI. In many implementations involving tensor loading and metadata extraction, such errors can lead to excessive memory consumption, heap corruption, or denial-of-service conditions where the application becomes unresponsive due to resource exhaustion. Because the stable-diffusion-webui is often deployed as a service accessible over networks, this vulnerability allows for remote exploitation. An attacker does not need local access to the system; they only need to provide a maliciously constructed safetensors file through any interface that triggers metadata extraction, such as uploading a model or triggering an automatic scan of available models within the UI environment.
The operational impact of this vulnerability is significant for users and organizations running these services in shared or public-facing environments. Successful exploitation could lead to service disruption by consuming all available system memory, effectively causing a denial-of-service against legitimate users attempting to generate images or manage models. Furthermore, depending on the specific implementation details of how the allocated resources are managed post-exploitation, there may be secondary risks related to information disclosure if the corrupted state allows for unintended data leakage from adjacent memory regions. The fact that an exploit has been made public increases the urgency of addressing this issue, as automated attacks leveraging known proof-of-concept code can target vulnerable instances indiscriminately across the internet.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write or CWE-400: Uncontrolled Resource Consumption, depending on whether the primary impact is memory corruption leading to arbitrary code execution potential or simply resource exhaustion leading to denial of service. In terms of adversary tactics, it relates to ATT&CK technique T1496: Resource Hijacking if used for cryptomining via excessive CPU/memory usage, or more broadly to initial access vectors where malicious models are uploaded to compromise the host environment. The project maintainers were notified early through an issue report but have not yet issued a patch or response, leaving users exposed during this window of vulnerability.
Mitigation strategies should focus on immediate operational controls since no official patch is currently available for versions up to 1.10.1. Administrators running stable-diffusion-webui should restrict access to the web interface using strong authentication mechanisms and network-level firewalls to prevent untrusted parties from uploading or triggering processing of model files. It is advisable to disable automatic metadata extraction features if they are not strictly necessary for workflow operations, thereby removing the attack vector entirely. Users should also avoid loading models from unverified sources until an official update addressing this header length validation flaw is released by the project maintainers. Monitoring system resources for unusual spikes in memory usage when processing new model files can serve as a detection mechanism for attempted exploitation activities.