Login Request a demo
Medium severity · published Oct 18, 2026
CVE-2026-111985
AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
stable-diffusion-webui · AUTOMATIC1111
1.10.0; 1.10.1 · source: vendor
Affected product
ST
stable-diffusion-webui
AUTOMATIC1111
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111985
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111985
github.com
https://github.com/AUTOMATIC1111/stable-diffusion-webui/
github.com
https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17498
github.com
https://github.com/user-attachments/files/32811560/poc.zip
vuldb.com
https://vuldb.com/cve/CVE-2026-111985
vuldb.com
https://vuldb.com/submit/1005484
vuldb.com
https://vuldb.com/vuln/421651
More from stable-diffusion-webui
9.6
CVE-2024-11045
Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui
7.5
CVE-2026-82288
Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags
7.5
CVE-2024-10935
Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui
6.5
CVE-2024-12074
Denial of Service in automatic1111/stable-diffusion-webui
6.5
CVE-2024-12375
Local File Inclusion in automatic1111/stable-diffusion-webui