stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor name
- Exploited
- No known exploitation
- Fix
- Fixed in master-763-4fcc6fe
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affected versions range from master-742-1a13107 to master-763-4fcc6fe. The untrusted imatrix file must be loaded (via --imat-in); no model file is needed.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 13/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
stable-diffusion.cpp, a C/C++ library for running diffusion models, has a heap out-of-bounds write in its imatrix loader that a local attacker can trigger without logging in, if a user is tricked into loading a crafted .imatrix file. Exploiting it lets the attacker write attacker-controlled values past heap buffers, which can corrupt the heap or crash the process.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::load_imatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entries with the same tensor name but resizes them only when they are empty. An untrusted .imatrix file can provide a small nval for the first entry and a larger nval for a second entry with the same name, causing the accumulation loop to write attacker-controlled floating-point and integer values beyond both heap buffers. Loading the file through the --imat-in conversion path can corrupt the heap or crash the process before a model is required. This issue is fixed in master-763-4fcc6fe.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.8/10CVSS 7.8
- No patch0/5No signal
What would change the score
- Would score about 63 if added to CISA KEV
- Would score about 58 if CISA's SSVC rates exploitation active
- Would score about 23 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Affected versions range from master-742-1a13107 to master-763-4fcc6fe. The untrusted imatrix file must be loaded (via --imat-in); no model file is needed.Upgrade to a fixed version: master-763-4fcc6fe.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- leejet stable-diffusion.cpp
fixed in master-763-4fcc6fe
Evidence 4
- Advisory
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-70659
Is CVE-2026-70659 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The imatrix loader in stable-diffusion.cpp writes past the end of a heap buffer when a file has a duplicate tensor name. The values and the size of the write can be set by the file, which can corrupt heap memory or crash the program.Source: github.com
Which versions are affected by CVE-2026-70659?
stable-diffusion.cpp: before master-763-4fcc6fe.Source: cve.now feed data
Am I affected, and how do I check?
Versions from master-742-1a13107 through master-763-4fcc6fe are affected, when an imatrix file is loaded with --imat-in. The advisory does not say the bug needs a model file. To check a build, compare its master build tag with that range.Source: github.com
How do I fix CVE-2026-70659?
Upgrade to master-763-4fcc6fe or later, which is the fixed version listed for this issue. Only load imatrix files from trusted sources until the build is updated.Source: github.com