Read the docs
TI-2026-85479 Aliases CVE-2026-70659

Heap out-of-bounds write in stable-diffusion.cpp imatrix loader

Priority LOW 33CWE-1284Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

stable-diffusion.cpp from master-742-1a13107 before master-763-4fcc6fe is affected. In the imatrix loader, entries that reuse a tensor name keep their buffers and are resized only when empty, so a crafted .imatrix file writes past heap buffers (CWE-787). A local attacker needs a user to load the crafted file through the --imat-in path, which can corrupt the heap or crash the process.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::load_imatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entries with the same tensor name but resizes them only when they are empty. An untrusted .imatrix file can provide a small nval for the first entry and a larger nval for a second entry with the same name, causing the accumulation loop to write attacker-controlled floating-point and integer values beyond both heap buffers. Loading the file through the --imat-in conversion path can corrupt the heap or crash the process before a model is required. This issue is fixed in master-763-4fcc6fe.

Why it matters now

EPSS 0.00128 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
leejetstable-diffusion.cpp< master-763-4fcc6fe—No fix listedCNA
  • stable-diffusion.cpp Vendorleejet Affected < master-763-4fcc6fe Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:leejet:stable-diffusion.cpp:*:*:*:*:*:*:*:*——leejet
  • cpe:2.3:a:leejet:stable-diffusion.cpp:*:*:*:*:*:*:*:* Versions — — ·leejet

Remediation

Upgrade stable-diffusion.cpp to master-763-4fcc6fe or later, the version that fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-70659
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-35250 stable-diffusion.cpp: Heap buffer overflow in GLOBAL opcode parsing for PyTorch checkpoint files CVSS 3.1HIGH 7.8
  • TI-2026-35249 stable-diffusion.cpp: Heap buffer overflow in SHORT_BINUNICODE parsing for PyTorch checkpoint files CVSS 3.1HIGH 7.8
  • TI-2026-35247 stable-diffusion.cpp has a Heap-based Buffer Overflow CVSS 3.1HIGH 7.8
  • TI-2026-35248 stable-diffusion.cpp: Out-of-bounds reads in PyTorch checkpoint pickle opcode parsing CVSS 3.1MEDIUM 5.5
  • TI-2026-85480 Out-of-bounds read in stable-diffusion.cpp safetensors loader CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences