CVE-2026-70659High· 7.8▾ Twilightstable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::load_imatrix in src/runt…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::load_imatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entries with the same tensor name but resizes them only when they are empty. An untrusted .imatrix file can provide a small nval for the first entry and a larger nval for a second entry with the same name, causing the accumulation loop to write attacker-controlled floating-point and integer values beyond both heap buffers. Loading the file through the --imat-in conversion path can corrupt the heap or crash the process before a model is required. This issue is fixed in master-763-4fcc6fe.
stable-diffusion.cpp < master-763-4fcc6feRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-70660Medium· 6.9stable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated data_offsets allow a tensor's byte range to extend past the end of the file
CVE-2026-94395High· 7.0Stack-based buffer overflow in SafeNet Authentication Client SIS token engine
CVE-2026-103594Critical· 9.5Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution
CVE-2026-93475Critical· 9.3Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
CVE-2026-91041High· 7.8FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image
CVE-2026-31712High· 8.3In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE size in smb_check_perm_dacl() Both ACE-walk loops in smb_check_perm_dacl() only guard against an under-sized remaining buffer, not against a…