---
id: CVE-2026-70660
title: >-
  stable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated
  data_offsets allow a tensor's byte range to extend past the end of the file
summary: >-
  stable-diffusion.cpp is a pure C/C++ library for running diffusion model
  (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior
  to master-764-e22272e, the safetensors loader in
  src/model_io/safetensors_io.cpp trust…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: leejet
product: stable-diffusion.cpp
affected:
  - stable-diffusion.cpp < master-764-e22272e
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:27:53.815Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-70660'
references:
  - url: >-
      https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w
    label: >-
      https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v2m4-h57v-fr6w
  - url: 'https://github.com/leejet/stable-diffusion.cpp/pull/1754'
    label: 'https://github.com/leejet/stable-diffusion.cpp/pull/1754'
  - url: >-
      https://github.com/leejet/stable-diffusion.cpp/commit/e22272ee631b742dab4440c18eb8fcafb0689402
    label: >-
      https://github.com/leejet/stable-diffusion.cpp/commit/e22272ee631b742dab4440c18eb8fcafb0689402
  - url: >-
      https://github.com/leejet/stable-diffusion.cpp/releases/tag/master-764-e22272e
    label: >-
      https://github.com/leejet/stable-diffusion.cpp/releases/tag/master-764-e22272e
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.901Z'
---

## Overview

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/model_io/safetensors_io.cpp trusts each tensor's data_offsets after checking only that nbytes equals end - begin. A crafted .safetensors file can declare a byte range beyond the file's data section, causing src/model_loader.cpp to consume an attacker-chosen length from an unchecked mapped-file offset. Loading the model can read adjacent process memory into tensor buffers or crash the process. This issue is fixed in master-764-e22272e.

## Affected

- `stable-diffusion.cpp < master-764-e22272e`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.