stable-diffusion.cpp: safetensors loader trusts data_offsets, reading process memory past the tensor data section

Impact

The safetensors loader verified only that a tensor's declared nbytes equalled end - begin, never that the byte range stayed inside the file's data section. A crafted .safetensors file makes model_loader.cpp copy an attacker-chosen length from an unchecked offset in the mapped file, so loading the model pulls adjacent process memory into tensor buffers or crashes the loader. On a serving host that accepts user-supplied checkpoints or LoRAs, that means whatever else lives in the inference process address space - other tenants' prompts, API tokens, previously loaded weights - can be read back out through generated tensors, or the worker can be killed on demand. Exploitation requires getting a file in front of the loader, which is routine wherever operators let users bring their own models.

Who can reach it

Anyone who can place or upload a model file that the server loads - a tenant supplying a checkpoint, or a user downloading an untrusted model from a hub. No authentication to the library itself; the vector is the model file.

What to do

Upgrade to master-764-e22272e (commit e22272ee631b) or later and restart the serving processes; no node reboot is needed. Until then, load only checkpoints from sources you control and keep conversion/loading of untrusted files in a throwaway sandbox with no secrets in the address space.

References

Related entries

• llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
• llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium
• BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium
• vLLM: DeepStream backend misclassification skips pixel limits and lets unauthenticated video exhaust GPU decodeCVE-2026-78684 · vLLM (DeepStream GPU decode path, pixel-limit enforcement)Medium
• llama.cpp RPC server: crafted tensor dimensions hit a reachable assertion and abort the processCVE-2026-86317 · llama.cpp RPC server (rpc_server::deserialize_tensor in ggml/src/ggml-rpc/ggml-rpc.cpp)Medium
• vLLM: audio extracted from video input ignores decode size and duration limitsCVE-2026-90554 · vLLM (NanoNemotronVL audio-from-video extraction, _extract_audio_from_videos)Medium