Memory Exposure and Process Crash in Stable Diffusion C/C++ Library by LeeJet
CVE-2026-70660

6.9MEDIUM

Key Information:

Vendor

Leejet

Status
Stable-diffusion.cpp
Vendor
CVE Published:
5 November 2026

What is CVE-2026-70660?

The Stable Diffusion C/C++ library, utilized for running various diffusion model inferences, contains a weakness in its safetensors loader. This issue allows a specially crafted .safetensors file to exploit a flaw in data validation, leading to the potential for reading adjacent process memory into tensor buffers or causing the application to crash. This vulnerability was addressed in the update following the master-764-e22272e commit, ensuring that proper checks are enforced when handling tensor data offsets.

Affected Version(s)

stable-diffusion.cpp < master-764-e22272e

References

https://github.com/leejet/stable-diffusion.cpp/security/a...
x_refsource_CONFIRM
https://github.com/leejet/stable-diffusion.cpp/pull/1754
x_refsource_MISC
https://github.com/leejet/stable-diffusion.cpp/commit/e22...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.