A vulnerability in LeeJet's stable‑diffusion.cpp allows an attacker to craft a .safetensors file that specifies data offsets beyond the actual file content. The library’s loader trusts the provided offsets after only verifying that the reported number of bytes equals the end minus the beginning. This omission enables an out‑of‑bounds read, potentially exposing arbitrary adjacent memory contents into tensor buffers or causing a crash. The impact is primarily confidentiality and process stability, as attacker‑selected data can be read from memory locations not intended to be part of the model.

The issue exists in LeeJet stable‑diffusion.cpp in any version prior to master‑764‑e22272e. All users employing this library to load safetensors models are vulnerable.

With a CVSS score of 6.9 the vulnerability is moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, indicating no confirmed mass exploitation yet. The likely attack vector is local: an attacker who can supply a malicious safetensors file to the application will trigger the out‑of‑bounds read. Proper bounds checking is required to mitigate this risk.