CVE-2026-111985: Allocation of Resources in AUTOMATIC1111 stable-diffusion-webui

This vulnerability in AUTOMATIC1111 stable-diffusion-webui up to versions 1.10.0 and 1.10.1 involves improper handling of the header length field in the read_metadata_from_safetensors function within the Metadata Extraction component. Manipulating this argument can cause unintended allocation of resources, potentially leading to denial of service or other resource exhaustion impacts. The vulnerability can be exploited remotely without privileges or user interaction. Although the issue was reported early, no official fix or patch has been released as of the publication date. A public exploit is available, increasing the risk of exploitation.

The vulnerability allows remote attackers to manipulate resource allocation via the header length field in metadata extraction, potentially causing resource exhaustion or denial of service conditions. There is no indication of confidentiality, integrity, or availability impacts beyond resource allocation. The presence of a public exploit increases the likelihood of exploitation, but no active widespread exploitation is confirmed.

No official fix or patch is currently available. Users should monitor the vendor's communications for updates. Until a patch is released, consider limiting exposure of the vulnerable service to untrusted networks and applying network-level protections to reduce attack surface. Avoid processing untrusted safetensors files to mitigate risk.