Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-111985: stable-diffusion-webui may consume excessive resources when queried
CVE-2026-111985 · published today
Summary
The web interface used for generating images can be tricked into using a lot of memory or CPU when it processes specially crafted files. An attacker could send such a file over the network and cause the server to slow down or become unavailable. Update to version 1.10.2 or later, or apply the provided patch, and avoid processing untrusted files.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| automatic1111 | stable-diffusion-webui | 1.10.0 |
Original advisory text
AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources
A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
References
- https://vuldb.com/cve/CVE-2026-111985 Vendor Advisory
- https://vuldb.com/submit/1005484 Vendor Advisory
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17498 Third Party Advisory
- https://github.com/user-attachments/files/32811560/poc.zip Exploit
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/ URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-1119... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-111985 Vendor Advisory
- https://vuldb.com/vuln/421651 Vendor Advisory
- https://vuldb.com/vuln/421651/cti Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
7.8
High
Type
CWE-400Uncontrolled Resource Consumption
CWE-770Allocation of Resources Without Limits
Timeline
Published18 Oct 2026
Updated19 Oct 2026
First seen18 Oct 2026
Track software like this
Free during beta