CVE-2026-70660
A safetensors file could make stable-diffusion.cpp read past the file boundary
stable-diffusion.cpp project · stable-diffusion.cpp safetensors model loader
First documented disclosure · Review checkpoint
Summary
A model load could crash or copy adjacent memory into a tensor buffer when offsets referred outside the file.
Severity and exploitation evidence
Medium · 6.9/10 · CVSS 4.0. Severity source.
Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.
Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.
How the weakness works
The loader did not fully validate tensor byte ranges against the model file before reading them.
Conditions required
An affected loader opens an untrusted safetensors model file.
Potential impact
The process could crash or read unrelated memory. External disclosure depends on what happens to the resulting tensor data.
Affected versions and configurations
Before master-764-e22272e.
Fix and mitigation status
master-764-e22272e.
Practical next steps
Upgrade to master-764-e22272e or later before loading untrusted safetensors files.
Operating lesson
Validate both the length and the location of every tensor against the actual file size.
Evidence and limits
The project published the patch and fixed build July 6 and the security advisory September 27.
Sources
- stable-diffusion.cpp project | A safetensors file could make stable-diffusion.cpp read past the file boundary
Primary source ·
- GitHub_M CVE record
Primary source ·
- Project security advisory and affected range
Primary source ·