CVE-2026-111985 | AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 Metadata Extraction modules/sd_models.py read_metadata_from_safetensors header length field allocation of resources (Issue 17498)

October 17, 2026 Yanac

A vulnerability described as problematic has been identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources.

This vulnerability is known as CVE-2026-111985. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More