CVE-2026-70659highCWE-1284CWE-787

CVE-2026-70659: falha de alta gravidade em leejet stable-diffusion.cpp

stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor name

Publicada em

Seguir esta CVE+ Monitorar stable-diffusion.cpp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.8epss 0.1%
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::load_imatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entries with the same tensor name but resizes them only when they are empty. An untrusted .imatrix file can provide a small nval for the first entry and a larger nval for a second entry with the same name, causing the accumulation loop to write attacker-controlled floating-point and integer values beyond both heap buffers. Loading the file through the --imat-in conversion path can corrupt the heap or crash the process before a model is required. This issue is fixed in master-763-4fcc6fe.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
leejet · stable-diffusion.cpp
CVEs relacionadas — leejet stable-diffusion.cpp

No mesmo produto, das mais perigosas para as menos.

CVE-2026-47749HIGHstable-diffusion.cpp: Heap buffer overflow in SHORT_BINUNICODE parsing for PyTorch checkpoint filesEPSS 0.2%CVE-2026-47747HIGHstable-diffusion.cpp has a Heap-based Buffer OverflowEPSS 0.2%CVE-2026-47750HIGHstable-diffusion.cpp: Heap buffer overflow in GLOBAL opcode parsing for PyTorch checkpoint filesEPSS 0.2%CVE-2026-47748MEDIUMstable-diffusion.cpp: Out-of-bounds reads in PyTorch checkpoint pickle opcode parsingEPSS 0.2%CVE-2026-70660MEDIUMstable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated data_offsets allow a tensor's byte range to extend past the end of the fileEPSS 0.1%