{"id":"CVE-2026-70660","summary":"stable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated data_offsets allow a tensor's byte range to extend past the end of the file","details":"stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/model_io/safetensors_io.cpp trusts each tensor's data_offsets after checking only that nbytes equals end - begin. A crafted .safetensors file can declare a byte range beyond the file's data section, causing src/model_loader.cpp to consume an attacker-chosen length from an unchecked mapped-file offset. Loading the model can read adjacent process memory into tensor buffers or crash the process. This issue is fixed in master-764-e22272e.","aliases":["GHSA-v2m4-h57v-fr6w"],"modified":"2026-11-05T21:32:26.656688232Z","published":"2026-11-05T15:27:53.815Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70660.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70660.json"},{"type":"FIX","url":"https://github.com/leejet/stable-diffusion.cpp/commit/e22272ee631b742dab4440c18eb8fcafb0689402"},{"type":"FIX","url":"https://github.com/leejet/stable-diffusion.cpp/pull/1754"},{"type":"WEB","url":"https://github.com/leejet/stable-diffusion.cpp/releases/tag/master-764-e22272e"},{"type":"ADVISORY","url":"https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70660"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/leejet/stable-diffusion.cpp","events":[{"introduced":"0"},{"fixed":"e22272ee631b742dab4440c18eb8fcafb0689402"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"master-764-e22272e"}]},{"range":[{"fixed":"e22272ee631b742dab4440c18eb8fcafb0689402"}],"source":"REFERENCES_COMMIT"},{"original_tag":"master-764-e22272e","range":[{"fixed":"e22272ee631b742dab4440c18eb8fcafb0689402"}],"source":"REFERENCES_TAG"}]}}],"versions":["master-763-4fcc6fe","master-762-9e1055d","master-760-e071aa3","master-758-c674225","master-752-38a51f8","master-750-e790073","master-749-b11c95a","master-748-68f3d6d","master-747-7bcd189","master-746-2574f59","master-745-7dab366","master-744-556f04b","master-743-3590aa8","master-742-1a13107","master-741-484baa4","master-740-2bb0389","master-739-ccda89e","master-738-f027107","master-737-3b6c9ca","master-736-57e19fa","master-735-61a637b","master-734-3ec374a","master-733-0484600","master-731-9f855c9","master-730-7b5f34d","master-728-03e9a22","master-727-f54e45e","master-721-8caa3f9","master-720-2938272","master-719-f440ad9","master-718-41f7acb","master-717-b395a69","master-716-854bebf","master-715-787d229","master-714-b12098f","master-713-2bd249c","master-712-e9e9524","master-711-e8e012e","master-709-92a3b73","master-708-710bc91","master-707-5a34bc7","master-706-146b6cc","master-705-93527fd","master-704-6e66a1a","master-703-bb90bfa","master-700-c2df4e1","master-699-9838264","master-697-5db680c","master-696-749186c","master-695-bdb431a","master-694-276025e","master-693-8d4c7af","master-692-9b0fceb","master-691-563137a","master-690-3a54597","master-688-1fb6b22","master-687-c20769b","master-686-1b702a5","master-685-19bdfe2","master-684-138da14","master-683-17a2b4a","master-682-b3d56d0","master-681-2a07540","master-680-81abfb2","master-679-f3fd359","master-678-dfb2390","master-677-cfbc19d","master-676-b9254dd","master-675-0648f44","master-674-74f513d","master-673-064001b","master-672-1f9ee88","master-671-a7f2e03","master-670-4513e3f","master-669-2d40a8b","master-668-9c7f9a2","master-667-ed74577","master-666-7948df8","master-665-02f0637","master-664-f8935d6","master-663-be65ac7","master-662-20901f6","master-661-0982807","master-660-d2797b8","master-659-d3b2cb0","master-658-b4ba55d","master-657-b54bd83","master-656-0e4ee04","master-655-29ab511","master-652-92dc726","master-651-07b2b18","master-650-1ceb5bd","master-649-202c615","master-647-72e512a","master-646-0baf721","master-645-645e6e9","master-644-cbf9219","master-643-8cf55a3","master-642-3a8788c","master-641-449165c","master-640-adaa599","master-639-2e35146","master-638-47d8198","master-637-ef92a00","master-636-b3374e6","master-635-bdd937f","master-634-c51ec7c","master-633-5b0267e","master-632-0045a72","master-625-f683c88","master-624-21fd4e6","master-621-baf7eda","master-620-e7eb92f","master-619-50134e5","master-618-e43b24c","master-617-06accf2","master-616-cde20d5","master-615-67dda3f","master-612-d7ecbe1","master-611-3633072","master-610-0c1ca17","master-608-38b14ad","master-607-fd1a279","master-606-db08b84","master-605-686856e","master-602-0665a7f","master-601-eeac950","master-600-57ff2eb","master-599-9d68341","master-597-6ee0684","master-596-90e87bc","master-595-586b6f1","master-594-9097ce5","master-593-3d6064b","master-592-b8079e2","master-591-331cfa5","master-589-f40a707","master-588-970c4a3","master-587-b8bdffc","master-586-c97702e","master-585-44cca3d","master-584-0a7ae07","master-583-6614334","master-582-7023fc4","master-581-e77e4c4","master-580-7d33d4b","master-579-3c99f70","master-578-4d626d2","master-577-f3f69e2","master-576-6a9cb31","master-575-2bcff67","master-572-1b4e9be","master-570-5c243db","master-569-c41c5de","master-568-9ac7b67","master-567-ee5bf95","master-564-fd35047","master-563-7ade90e","master-562-118489e","master-561-be9f51b","master-560-e8323ca","master-559-dd75372","master-558-8afbeb6","master-557-5bf438d","master-556-359eb8b","master-555-7397dda","master-554-9369ab7","master-553-687a81f","master-552-87ecb95","master-551-99c1de3","master-550-09b12d5","master-549-6dfe945","master-548-bf02167","master-547-4fe7a35","master-546-4d52320","master-545-1d6cb0f","master-544-83e8f6f","master-543-8d87887","master-542-02dd5e5","master-541-8f2967c","master-540-f16a110","master-539-ed88e21","master-537-545fac4","master-536-5265a5e","master-535-84cbd88","master-534-997bb11","master-533-862a658","master-529-630ee03","master-528-f6968bc","master-527-adfef62","master-525-d6dd6d7","master-523-c8fb3d2","master-522-3d33caa","master-521-9b424db","master-520-d950627","master-519-7c880f8","master-517-ba35dd7","master-516-d41f5ff","master-515-810ef0c","master-514-5792c66","master-513-39d5470","master-512-60889bc","master-511-e64baa3","master-509-4cdfff5","master-507-b314d80","master-506-c9cd497","master-505-c5eb1e4","master-504-636d3cb","master-503-adea272","master-502-45ce78a","master-500-3296545","master-499-d60fb27","master-498-c7ccafb","master-497-aa0b899","master-496-5e26437","master-495-f0f641a","master-494-9f56833","master-493-65891d7","master-492-f957fa3","master-490-e63daba","master-489-3959109","master-487-43e829f","master-486-7837232","master-485-4ccce02","master-484-fa61ea7","master-483-5e4579c","master-482-3295711","master-480-b87fe13","master-479-e50e1f2","master-478-c6206fb","master-477-639091f","master-475-2efd199","master-474-61659ef","master-473-9565c7f","master-472-fbce16e","master-471-7010bb4","master-470-48d3161","master-468-885e62e","master-467-0e52afc","master-466-27b5f17","master-463-e7e83ed","master-462-c5602a6","master-457-b90b1ee","master-456-2cef4ba","master-455-a119a4d","master-454-6eefd2d","master-453-4ff2c8c","master-452-51bd9c8","master-451-d0d836a","master-450-a2d83dd","master-449-cc10771","master-448-37c9860","master-447-ccb6b0a","master-446-df4efe2","master-445-860a78e","master-444-a0adcfb","master-443-3d5fdd7","master-442-3e6c428","master-440-3e81246","master-438-298b110","master-437-30a9113","master-435-ca5b196","master-434-50ff966","master-433-88ec9d3","master-432-60abda5","master-431-23fce0b","master-430-7c88c47","master-427-78e15bd","master-426-97cf2ef","master-425-bda7fab","master-424-c2e18c8","master-423-c3ad6a1","master-422-ebe9d26","master-421-9fa7f41","master-420-a23262d","master-419-e687913","master-418-200cb6f","master-417-43a70e8","master-416-614f873","master-415-d96b415","master-414-8f05f5b","master-413-15d0f82","master-412-6888fcb","master-411-2aecdd5","master-410-11ab095","master-409-a3a88fc","master-408-8823dc4","master-407-1ac5a61","master-406-d939f6e","master-405-e72aea7","master-403-583a02e","master-402-96c3e64","master-401-0392273","master-398-2f0bd31","master-397-bfbb929","master-396-689e44c","master-395-985aedd","master-394-3f3610b","master-393-118683d","master-392-bcc9c0d","master-391-5865b5e","master-390-edf2cb3","master-387-e4c50f1","master-386-0743a1b","master-385-34a6fd4","master-383-20eb674","master-382-bc80225","master-380-673dbdd","master-379-0249509","master-378-52b67c5","master-377-2034588","master-376-490c51d","master-375-45c4677","master-373-e9bc3b6","master-372-b542894","master-371-5498cc0","master-370-aa2b8e0","master-369-a14e2b3","master-368-28ffb6c","master-367-b88cc32","master-366-f532972","master-365-d5b05f7","master-364-6d6dc1b","master-363-199e675","master-362-742a733","master-361-e8eb379","master-360-aa44e06","master-359-6448430","master-358-347710f","master-357-59ebdf0","master-356-4ffcbca","master-355-694f0d9","master-354-8ecdf05","master-353-ee89afc","master-352-d2d3944","master-351-0fa3e1a","master-350-c2d8ffc","master-349-fb748bb","master-348-8f6c5c2","master-347-6103d86","master-346-c42826b","master-343-dd75fc0","master-341-8a45d0f","master-340-9e28be6","master-339-062490a","master-338-faabc5a","master-336-917f7bf","master-335-48e0a28","master-334-d05e46c","master-333-64a7698","master-332-0723ee5","master-331-90ef5f8","master-330-db6f479","master-326-40a6a87","master-325-e370258","master-324-a7d6d29","master-323-2e9242e","master-322-c64994d","master-321-5436f6b","master-320-1c32fa0","master-319-9727c6b","master-318-beb99a2","master-317-aa68b87","master-316-5b261b9","master-315-e70d020","master-314-02af48a","master-309-35843c7","master-306-2abe945","master-305-f3140ea","master-302-1e0d282","master-301-fd693ac","master-300-171b222","master-299-567f9f1","master-298-1e5f207","master-97ad3e7","master-8909523","master-8376dfb","master-0ebe6fe","master-55c2e05","master-52a97b3","master-2c9b1e2","master-dc46993","master-9e7befa","master-c607fc3","master-b54bec3","master-5869987","master-48956ff","master-ddc4a18","master-fce6afc","master-49d6570","master-6bbaf16","master-87cdbd5","master-b017918","master-ac5a215","master-abb36d6","master-ff4fdbb","master-abb115c","master-c648001","master-c587a43","master-f8fe4e7","master-675208d","master-d7f430c","master-141a4b4","master-21ce9fe","master-cb1d975","master-2eb3845","master-4c6475f","master-eea77cb","master-0e86d90","master-5b8996f","master-f7f05fb","master-6167e29","master-f6b9aa1","master-7eb30d0","master-59080d3","master-eed97a5","master-bd1eaef","master-ab835f7","master-1896b28","master-0739361","master-a772dca","master-6d84a30","master-dafc32d","master-225162f","master-b9e4718","master-1ce1c1a","master-19fbfd8","master-76c7262","master-3bae667","master-8d0819c","master-83ef4e4","master-7dac89a","master-9251756","master-ecf5db9","master-23de7fc","master-d42fd59","master-0d8b39f","master-b1fc16b","master-a28d04d","master-45d0ebb","master-b1cc40c","master-c9b5735","master-10c6501","master-10feacf","master-d7c7a34","master-81556f3","master-3fb275a","master-30b3ac8","master-195d170","master-f50a7f6","master-85e9a12","master-fbd42b6","master-19d876e","master-f27f2b2","master-69c7378","master-838beb9","master-f23b803","master-1be2491","master-3753223","master-d46ed5e","master-2535ad5","master-d9b5942","master-587a37b","master-4fe83d5","master-dcf91f9","master-0d9d665","master-8f4ab9a","master-cc92a6a","master-9578fdc","master-b5f4932","master-1c168d9","master-2b1bc06","master-8c7719f","master-8f94efa","master-6ea8122","master-9b1d90b","master-65fa646","master-ac54e00","master-14206fd","master-e410aeb","master-e71ddce","master-f4c937c","master-0362cc4","master-6c88ad3","master-dc0882c","master-d00c948","master-2d4a2f7","master-353ee93","master-2027b16","master-8847114","master-5c561ea","master-f5997a1","master-1bdc767","master-79c9fe9","master-c837c5d","master-64d231f","master-697d000","master-3d854f7","master-4a6e36e","master-73c2176","master-9c51d87","master-e1384de","master-8142803","master-1d2af5c","master-ce1bcc7","master-760cfaa","master-6d16f68","master-036ba9e","master-ec82d52","master-afea457","master-646e776","master-3ac48ea","master-90e9178","master-48bcce4","master-a469688","master-1ce9470","master-a65c410","master-7be65fa","master-d164236","master-ef5c3f7","master-b7870a0","master-4a81904","master-730585d","master-193fb62","master-b636886","master-349439f","master-36ec16a","master-c6071fa","master-5c614e4","master-2b6ec97","master-7cb41b1","master-7fb8a51","master-2c5f3fc","master-f2e4d97","master-4a5e7b5","master-2e79a82","master-14da17a","master-78ad76f","master-004dfbe","master-0e64238","master-8f6b4a3","master-9842a3f","master-ac8f5a0","master-ca33304","master-69efe3c","master-2eac844","master-134883a","master-f99bcd1","master-8a87b27","master-d7af2c2","master-47dd704","master-f469b83","master-8124588","master-ae1d5dc","master-51b53d4","master-0d9b801","master-176a00b","master-9a9f3da","master-536f3af","master-3bf1665","master-ed37498","master-fbd18e1","master-09cab2a","master-afec505","master-3a25179","master-968fbf0","master-b6899e8","master-b85b236","master-b247581","master-7620b92","master-3ffffa6","master-4584286","master-e5a7aec","master-31e77e1","master-c542a77","master-1b5a868","master-c8f85a4","master-d765b95","master-0d7f04b","master-5ae4795"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70660.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"}]}