leejet stable-diffusion.cpp IMatrix Loading src/runtime/imatrix.cpp load_imatrix heap-based overflow

Summaryinfo

A vulnerability was found in leejet stable-diffusion.cpp. It has been rated as problematic. This issue affects the function IMatrixCollector::load_imatrix of the file src/runtime/imatrix.cpp of the component IMatrix Loading. The manipulation leads to heap-based overflow. This vulnerability is documented as CVE-2026-70659. The attack needs to be performed locally. There is not any exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in leejet stable-diffusion.cpp (version unknown) and classified as problematic. This issue affects the function IMatrixCollector::load_imatrix of the file src/runtime/imatrix.cpp of the component IMatrix Loading. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::load_imatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entries with the same tensor name but resizes them only when they are empty. An untrusted .imatrix file can provide a small nval for the first entry and a larger nval for a second entry with the same name, causing the accumulation loop to write attacker-controlled floating-point and integer values beyond both heap buffers. Loading the file through the --imat-in conversion path can corrupt the heap or crash the process before a model is required. This issue is fixed in master-763-4fcc6fe.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-70659 since 08/04/2026. The exploitation is known to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Applying the patch master-763-4fcc6fe is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• leejet

Name

• stable-diffusion.cpp

Website

• Product: https://github.com/leejet/stable-diffusion.cpp/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion