CVE-2026-111985: stable-diffusion-webui: safetensors header DoS via memory

MEDIUM

Published October 18, 2026

CISO Take

AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 does not validate the header length field when it reads safetensors metadata. A crafted model file can therefore make the application allocate excessive resources and degrade or crash the service. The impact is availability only (CVSS 4.3, A:L), and exploitation needs a user to load or browse the malicious file (UI:R). EPSS is low at 0.55% (about the 55th percentile), and the CVE is not in CISA KEV. A proof-of-concept archive has been published in the upstream GitHub issue, and the maintainers have not responded. No patched version exists, so the only controls are compensating ones. Do not expose the WebUI to untrusted networks, load only models from trusted sources, and cap memory per process or container so one bad file cannot take down a shared GPU host.

Sources:NVDEPSSATLASVulDBGitHub Issue Tracker

What is the risk?

Low to medium. The CVSS 3.1 base score is 4.3, with only a low availability impact and no confidentiality or integrity impact. The exploit is simple and a PoC is public (E:P), but it needs user interaction and a malicious model file reaching the instance. EPSS is 0.00546, the CVE is not in KEV, and there is no Nuclei template. Risk rises where the WebUI is internet-facing, shared between users, or runs on GPU hosts that also serve other workloads. There is no vendor fix, which prolongs exposure.

How does the attack unfold?

Initial Access

Attacker distributes or uploads a crafted safetensors model with an oversized header length field to a model hub or shared WebUI.

AML.T0010.003

User Execution

A victim loads or browses the model so the WebUI calls read_metadata_from_safetensors on it.

AML.T0011.000

Exploitation

The unchecked header length triggers excessive resource allocation in the WebUI process.

AML.T0049

Impact

The WebUI hangs or crashes, causing a denial of service for image-generation workloads.

AML.T0029

Initial Access

Attacker distributes or uploads a crafted safetensors model with an oversized header length field to a model hub or shared WebUI.

AML.T0010.003

User Execution

A victim loads or browses the model so the WebUI calls read_metadata_from_safetensors on it.

AML.T0011.000

Exploitation

The unchecked header length triggers excessive resource allocation in the WebUI process.

AML.T0049

Impact

The WebUI hangs or crashes, causing a denial of service for image-generation workloads.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
stable-diffusion-webui	—	—	No patch

Do you use stable-diffusion-webui? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CNone

INone

ALow

What should I do?

1 step

1) No patched release exists, so monitor GitHub issue #17498 and the upstream repository for a fix and apply it as soon as one ships. 2) Restrict WebUI access to trusted users and networks, using authentication (--gradio-auth), a VPN or a reverse proxy, and never expose it directly to the internet. 3) Only load safetensors, LoRA and checkpoint files from trusted, verified sources, and quarantine downloaded models before they reach the models directory. 4) Run the WebUI in a container or cgroup with memory limits and automatic restart so an oversized allocation cannot starve the host. 5) Optionally pre-validate safetensors headers (declared header length versus file size, with a sane maximum such as the 100 MB limit used in the reference safetensors implementation) before ingestion. 6) Detect by alerting on WebUI process out-of-memory kills, restarts and abnormal memory spikes around model scanning or loading.

How is it classified?

DoSSupply ChainFrameworkModelAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

NIST AI RMF

GOVERN 6.1-Policies and procedures address third-party AI risks

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-111985?

Is CVE-2026-111985 actively exploited?

No confirmed active exploitation of CVE-2026-111985 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-111985?

1) No patched release exists, so monitor GitHub issue #17498 and the upstream repository for a fix and apply it as soon as one ships. 2) Restrict WebUI access to trusted users and networks, using authentication (--gradio-auth), a VPN or a reverse proxy, and never expose it directly to the internet. 3) Only load safetensors, LoRA and checkpoint files from trusted, verified sources, and quarantine downloaded models before they reach the models directory. 4) Run the WebUI in a container or cgroup with memory limits and automatic restart so an oversized allocation cannot starve the host. 5) Optionally pre-validate safetensors headers (declared header length versus file size, with a sane maximum such as the 100 MB limit used in the reference safetensors implementation) before ingestion. 6) Detect by alerting on WebUI process out-of-memory kills, restarts and abnormal memory spikes around model scanning or loading.

What systems are affected by CVE-2026-111985?

This vulnerability affects the following AI/ML architecture patterns: Stable Diffusion image generation UIs, model serving, local model loading pipelines, shared GPU workstations.

What is the CVSS score for CVE-2026-111985?

CVE-2026-111985 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

Stable Diffusion image generation UIsmodel servinglocal model loading pipelinesshared GPU workstations

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker publishes a seemingly useful LoRA or checkpoint on a model-sharing site, or uploads it to a shared WebUI instance. The safetensors file declares an extremely large header length field. When a user selects the model, or the UI scans the models folder and reads its metadata, the application tries to allocate resources for the declared header size. The WebUI process exhausts memory and crashes or hangs, interrupting image generation for everyone on that instance and possibly affecting co-located GPU workloads. The attacker can repeat the attack by re-uploading the file.

Weaknesses (CWE)

CWE-400Uncontrolled Resource Consumption CWE-770Allocation of Resources Without Limits or Throttling

CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.

[Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
[Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Source: MITRE CWE corpus.