CVE-2026-70660

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70660", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-04T21:48:08.613Z", "datePublished": "2026-11-05T15:27:53.815Z", "dateUpdated": "2026-11-09T17:13:40.694Z"}, "containers": {"cna": {"title": "stable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated data_offsets allow a tensor's byte range to extend past the end of the file", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w"}, {"name": "https://github.com/leejet/stable-diffusion.cpp/pull/1754", "tags": ["x_refsource_MISC"], "url": "https://github.com/leejet/stable-diffusion.cpp/pull/1754"}, {"name": "https://github.com/leejet/stable-diffusion.cpp/commit/e22272ee631b742dab4440c18eb8fcafb0689402", "tags": ["x_refsource_MISC"], "url": "https://github.com/leejet/stable-diffusion.cpp/commit/e22272ee631b742dab4440c18eb8fcafb0689402"}, {"name": "https://github.com/leejet/stable-diffusion.cpp/releases/tag/master-764-e22272e", "tags": ["x_refsource_MISC"], "url": "https://github.com/leejet/stable-diffusion.cpp/releases/tag/master-764-e22272e"}], "affected": [{"vendor": "leejet", "product": "stable-diffusion.cpp", "versions": [{"version": "< master-764-e22272e", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T15:27:53.815Z"}, "descriptions": [{"lang": "en", "value": "stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/model_io/safetensors_io.cpp trusts each tensor's data_offsets after checking only that nbytes equals end - begin. A crafted .safetensors file can declare a byte range beyond the file's data section, causing src/model_loader.cpp to consume an attacker-chosen length from an unchecked mapped-file offset. Loading the model can read adjacent process memory into tensor buffers or crash the process. This issue is fixed in master-764-e22272e."}], "source": {"advisory": "GHSA-v2m4-h57v-fr6w", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T17:13:04.609428Z", "id": "CVE-2026-70660", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:13:40.694Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-70660", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T17:13:04.609428Z"}}}], "references": [{"url": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:13:17.390Z"}}], "cna": {"title": "stable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated data_offsets allow a tensor's byte range to extend past the end of the file", "source": {"advisory": "GHSA-v2m4-h57v-fr6w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "leejet", "product": "stable-diffusion.cpp", "versions": [{"status": "affected", "version": "< master-764-e22272e"}]}], "references": [{"url": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w", "name": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/leejet/stable-diffusion.cpp/pull/1754", "name": "https://github.com/leejet/stable-diffusion.cpp/pull/1754", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/leejet/stable-diffusion.cpp/commit/e22272ee631b742dab4440c18eb8fcafb0689402", "name": "https://github.com/leejet/stable-diffusion.cpp/commit/e22272ee631b742dab4440c18eb8fcafb0689402", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/leejet/stable-diffusion.cpp/releases/tag/master-764-e22272e", "name": "https://github.com/leejet/stable-diffusion.cpp/releases/tag/master-764-e22272e", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/model_io/safetensors_io.cpp trusts each tensor's data_offsets after checking only that nbytes equals end - begin. A crafted .safetensors file can declare a byte range beyond the file's data section, causing src/model_loader.cpp to consume an attacker-chosen length from an unchecked mapped-file offset. Loading the model can read adjacent process memory into tensor buffers or crash the process. This issue is fixed in master-764-e22272e."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T15:27:53.815Z"}}}, "cveMetadata": {"cveId": "CVE-2026-70660", "state": "PUBLISHED", "dateUpdated": "2026-11-09T17:13:40.694Z", "dateReserved": "2026-08-04T21:48:08.613Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T15:27:53.815Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "stable-diffusion.cpp", "vendor": "leejet", "versions": [{"status": "affected", "version": "< master-764-e22272e"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/model_io/safetensors_io.cpp trusts each tensor's data_offsets after checking only that nbytes equals end - begin. A crafted .safetensors file can declare a byte range beyond the file's data section, causing src/model_loader.cpp to consume an attacker-chosen length from an unchecked mapped-file offset. Loading the model can read adjacent process memory into tensor buffers or crash the process. This issue is fixed in master-764-e22272e."}], "id": "CVE-2026-70660", "lastModified": "2026-11-12T22:18:35.610", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70660", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T17:13:04.609428Z", "version": "2.0.3"}}]}, "published": "2026-11-05T16:17:48.263", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/leejet/stable-diffusion.cpp/commit/e22272ee631b742dab4440c18eb8fcafb0689402"}, {"source": "security-advisories@github.com", "url": "https://github.com/leejet/stable-diffusion.cpp/pull/1754"}, {"source": "security-advisories@github.com", "url": "https://github.com/leejet/stable-diffusion.cpp/releases/tag/master-764-e22272e"}, {"source": "security-advisories@github.com", "url": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "stable-diffusion.cpp: stable-diffusion.cpp: Information disclosure via crafted safetensors model file", "id": "2567438", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567438"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in stable-diffusion.cpp. The model loader does not properly validate tensor byte offset boundaries when parsing safetensors model files. An attacker could exploit this flaw by enticing a user or service to load a specially crafted model file, causing an out-of-bounds memory read. This can lead to information disclosure by exposing adjacent process memory, or result in a Denial of Service (DoS) from an application crash."], "mitigation": {"lang": "en:us", "value": "Avoid loading or processing model files (.safetensors) from untrusted or unverified sources. To reduce exposure, restrict model ingestion to verified internal repositories and isolate inference processes within unprivileged containers or sandboxed environments with limited access to host memory and sensitive files.\nCaveat: Restricting external model imports may disrupt automated pipelines or third-party workflows that rely on direct downloads of public model weights."}, "name": "CVE-2026-70660", "public_date": "2026-11-05T15:27:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-70660\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-70660\nhttps://github.com/leejet/stable-diffusion.cpp/commit/e22272ee631b742dab4440c18eb8fcafb0689402\nhttps://github.com/leejet/stable-diffusion.cpp/pull/1754\nhttps://github.com/leejet/stable-diffusion.cpp/releases/tag/master-764-e22272e\nhttps://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w"], "statement": "This vulnerability is rated as Important severity because an out-of-bounds memory read can lead to unauthorized disclosure of adjacent process memory or denial of service, despite requiring user interaction to supply the input. In typical Red Hat environments, exploitation requires an application using this library to ingest and map an untrusted, specially crafted safetensors format file. Workloads that operate strictly on verified, internally hosted diffusion weights without accepting external user-submitted models are not exposed to this risk.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,master-764-e22272e)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "stable-diffusion.cpp", "source": "cna", "vendor": "leejet"}, "product": "stable-diffusion.cpp", "vendor": "leejet"}], "created": "2026-11-05T16:45:06.031695+00:00", "updated": "2026-11-05T16:45:06.274004+00:00", "vendors": ["leejet", "leejet$PRODUCT$stable-diffusion.cpp"]}