CVE-2026-70660: stable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated data_offsets allow a tensor's byte range to extend past the end of the file
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/modelio/safetensorsio.cpp trusts each tensor's dataoffsets after checking only that nbytes equals end - begin. A crafted .safetensors file can declare a byte range beyond the file's data section, causing src/modelloader.cpp to consume an attacker-chosen length from an unchecked mapped-file offset. Loading the model can read adjacent process memory into tensor buffers or crash the process. This issue is fixed in master-764-e22272e.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stable-diffusion.cppto a version that resolves this vulnerability.Patch master-764-e22272e
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using stable-diffusion.cpp versions before master-764-e22272e are exposed when they load a crafted .safetensors model file. The attack requires local access and user interaction, as reflected by the CVSS vector.
What does an attacker need to do to exploit it?
An attacker needs to provide a .safetensors file whose tensor data_offsets specify a range extending beyond the file's data section. The vulnerable loader accepts the range after checking only that the declared byte count equals end minus begin.
What can happen if a malicious model is loaded?
The model-loading process can read adjacent process memory into tensor buffers or crash. The described impacts are high confidentiality and high availability impact.
What should be done if patching cannot happen immediately?
Do not load untrusted .safetensors files with the affected library. Limit model loading to files from trusted sources until the library is updated.
How can I determine whether my deployment is affected?
Check whether your build includes the fix identified as master-764-e22272e. Builds prior to that revision are affected when they load .safetensors files.