CVE-2026-70659
Description
A flaw was found in stable-diffusion.cpp. An attacker can trigger a heap-based buffer overflow by convincing a user to load a specially crafted importance matrix (.imatrix) file. Because the application reuses internal memory buffers without resizing them when encountering duplicate tensor entries, out-of-bounds data is written to the heap. This flaw can lead to arbitrary code execution, memory corruption, or a Denial of Service (DoS) crash.
Statement
Red Hat Product Security has rated this issue as having an Important security impact because successful exploitation can result in arbitrary code execution or a process crash within the application context. Exploitation requires user interaction to explicitly ingest a maliciously crafted importance matrix file during model conversion or quantization. Because this vector depends on processing external files locally and cannot be triggered across the network without user action, exposure is limited to environments actively handling untrusted third-party assets.
Mitigation
Avoid processing or loading untrusted importance matrix files during model conversion workflows. If handling external matrix files is required, run the conversion process within an isolated container or restricted sandbox with limited filesystem access and disabled network capabilities.
Caveat: Isolating execution environments may introduce operational overhead, but prevents potential arbitrary code execution from compromising the host system.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
