CVE-2026-70660 in stable-diffusion.cpp
Summary
by MITRE • 11/05/2026
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/model_io/safetensors_io.cpp trusts each tensor's data_offsets after checking only that nbytes equals end - begin. A crafted .safetensors file can declare a byte range beyond the file's data section, causing src/model_loader.cpp to consume an attacker-chosen length from an unchecked mapped-file offset. Loading the model can read adjacent process memory into tensor buffers or crash the process. This issue is fixed in master-764-e22272e.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability resides within the safetensors loader component of stable-diffusion.cpp, a widely used C and C++ library designed for executing inference on various diffusion models including Stable Diffusion, Flux, Wan, Qwen Image, and Z-Image. The core issue stems from an insufficient validation mechanism when parsing tensor metadata in the file src/model_io/safetensors_io.cpp prior to commit master-764-e22272e. Specifically, the implementation relies on a single check that verifies whether the number of bytes (nbytes) equals the difference between end and begin offsets. This logic fails to ensure that the declared data_offsets for each tensor remain within the actual boundaries of the mapped file's data section. Consequently, an attacker can craft a malicious .safetensors file where the metadata declares byte ranges extending beyond the physical limits of the file itself.
When such a crafted model is loaded, the source code in src/model_loader.cpp proceeds to consume memory based on these unchecked offsets. The library maps the file into process memory and then reads from an attacker-controlled length at an arbitrary offset within that mapped region. Because the validation does not account for the total size of the underlying file or the validity of the range relative to it, the application effectively performs a read operation outside its intended scope. This behavior allows the software to access adjacent areas in the process memory space that are unrelated to the model data. The operational impact is severe, as this can lead to the leakage of sensitive information residing in other parts of the application's memory footprint or cause a segmentation fault resulting in a denial of service by crashing the inference process.
From a technical classification perspective, this flaw aligns with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write if write operations were similarly unchecked, though the primary risk described is unauthorized memory disclosure or crash via out-of-bounds read. In terms of adversary tactics, this vulnerability facilitates information discovery through potential data exfiltration from process memory and could be leveraged for denial of service attacks against services relying on stable-diffusion.cpp for image generation tasks. The lack of strict boundary checks during the parsing of external model files represents a critical failure in input validation, allowing untrusted artifacts to dictate unsafe memory access patterns.
To mitigate this vulnerability, users must ensure they are running versions of stable-diffusion.cpp that include commit master-764-e22272e or later, which implements proper boundary checks for tensor data offsets. Developers integrating the library should verify that all file parsing routines strictly validate that declared ranges do not exceed the mapped file size before initiating memory reads. Additionally, implementing stricter input validation and employing static analysis tools to detect out-of-bounds access patterns can help prevent similar issues in future iterations of the codebase. Security practitioners monitoring for exploitation attempts should look for anomalous memory read operations originating from safetensors parsing routines within diffusion model inference engines.