[Bug]: safetensors header length (first 8 bytes) is used unchecked in file.read() — attacker-sized allocation attempt on every model scan

Checklist

• The issue exists after disabling all extensions
• The issue exists on a clean installation of webui
• The issue is caused by an extension, but I believe it is caused by a bug in the webui
• The issue exists in the current version of the webui
• The issue has not been reported before recently
• The issue has been reported before but has not been fixed yet

What happened?

read_metadata_from_safetensors() in modules/sd_models.py re-implements the safetensors header parse and uses the 8-byte little-endian length field from the start of the file directly as the size argument of file.read() (line 297: json_data = json_start + file.read(metadata_len-2)), without ever comparing it to the real file size. A .safetensors file of 40 bytes whose first 8 bytes encode 2^46 makes every model enumeration attempt a ~64 TiB read/allocation inside the WebUI process. This happens automatically at startup (list_models() -> CheckpointInfo -> cache reader) and on every checkpoint refresh; the MemoryError raised by the oversized read is caught by the product's own except Exception and logged as "*** Error reading metadata from file: ...". Verified on v1.10.1 (commit 82a973c04367123ae98bd9abdf80d9eda9b910e2) on Linux (WSL2 Ubuntu 24.04, Python 3.10.21, vm.overcommit_memory=0): two crafted files (declared header lengths 2^40 and 2^46) both produce MemoryError at sd_models.py:297 during startup, while an honest control file produced no error; the server stayed up and GET /sdapi/v1/sd-models still listed all three files. The same unmodified code is present on the current master branch (verified 2026-09-29). The official safetensors parser cross-checks the declared header length against the file size (and enforces an absolute header cap); this hand-written parser skips both. Suggested fix: bound metadata_len by os.fstat(file.fileno()).st_size before the read, or delegate metadata extraction to the safetensors library.

Steps to reproduce the problem

1. Check out commit 82a973c04367123ae98bd9abdf80d9eda9b910e2 and confirm the sink: grep -n "file.read(metadata_len-2)" modules/sd_models.py # -> line 297
2. Craft a 40-byte checkpoint whose declared header length is 2^46: python3 -c "import json,struct; body=json.dumps({'metadata':{'format':'pt'}},separators=(',',':')).encode(); open('models/Stable-diffusion/pos_huge.safetensors','wb').write(struct.pack('<Q',246)+body)" (optionally also 240; keep one honest safetensors file written by safetensors.torch.save_file as a control)
3. Start the WebUI as usual: bash webui.sh -f --api --skip-torch-cuda-test --skip-version-check --no-half --use-cpu all --no-download-sd-model --skip-load-model-at-start --port 7861
4. Watch the console during startup model enumeration (or afterwards run curl http://127.0.0.1:7861/sdapi/v1/sd-models and re-check the console).
5. Expected sink: two log blocks "*** Error reading metadata from file: .../pos_huge.safetensors" with a traceback ending in "File .../modules/sd_models.py, line 297, in read_metadata_from_safetensors ... MemoryError"; the control file produces no such block.

poc.zip

What should have happened?

The parser should validate the declared header length against the actual file size (and impose the safetensors ecosystem's absolute header cap, 100 MB, as the official parser does) before using it in file.read(), and skip/refuse malformed files without attempting attacker-sized allocations.

What browsers do you use to access the UI ?

Other

Sysinfo

Attached: sysinfo-2026-09-29.json. Generated from the same verification instance through GET /internal/sysinfo — the endpoint behind Settings -> Sysinfo -> Download system info — while the WebUI was running on the pinned commit 82a973c04367123ae98bd9abdf80d9eda9b910e2 (Version field: 1.10.1; Platform: Linux-6.18.33.2-microsoft-standard-WSL2-x86_64-with-glibc2.39). Reviewed before delivery: no usernames, hostnames or home-directory paths are present; Script path / Data path / Extensions dir record only the neutral reproduction tree /opt/a1111-repro. Attach this file as-is.

sysinfo-2026-09-29.json

Console logs

Python 3.10.21 (main, Aug 13 2026, 09:45:30) [GCC 13.3.0]
Version: 1.10.1
Commit hash: 82a973c04367123ae98bd9abdf80d9eda9b910e2
Launching Web UI with arguments: -f --api --skip-torch-cuda-test --skip-version-check --no-half --use-cpu all --no-download-sd-model --skip-load-model-at-start --port 7861
no module 'xformers'. Processing without...
No module 'xformers'. Proceeding without it.
Warning: caught exception 'Torch not compiled with CUDA enabled', memory monitor disabled
*** Error reading metadata from file: /opt/a1111-repro/webui/models/Stable-diffusion/pos/huge_1tib.safetensors
    Traceback (most recent call last):
      File "/opt/a1111-repro/webui/modules/sd_models.py", line 297, in read_metadata_from_safetensors
        json_data = json_start + file.read(metadata_len-2)
    MemoryError

---
*** Error reading metadata from file: /opt/a1111-repro/webui/models/Stable-diffusion/pos/huge_64tib.safetensors
    Traceback (most recent call last):
      File "/opt/a1111-repro/webui/modules/sd_models.py", line 297, in read_metadata_from_safetensors
        json_data = json_start + file.read(metadata_len-2)
    MemoryError

---
Running on local URL:  http://127.0.0.1:7861
Startup time: 20.6s (prepare environment: 0.1s, import torch: 7.5s, import gradio: 2.2s, setup paths: 1.1s, initialize shared: 0.1s, other imports: 1.0s, load scripts: 0.9s, create ui: 0.6s, gradio launch: 6.8s, add APIs: 0.3s).

Additional information

Sample SHA-256: 2^40 variant 91d436a9fd34f8e000cf5bb3a1c1a6d838d376724a48a327116b67b3acd542d8; 2^46 variant b469f12696cddc608b533422c14eff602a1f4de248ee6c9096a479ecbccdf7de; honest control 2fb5d48eb484a0d41857d2fa531df5994c7290065bab9ae1bf59dd532b5861da (144 bytes, written by safetensors.torch.save_file, honest 120-byte declared length, no error). The declared length is fully attacker-controlled; no user interaction with the UI is needed beyond normal startup with the file present in models/Stable-diffusion/. Availability impact observed: per-file metadata denied + repeated oversized allocation attempts + traceback log noise; the process survives (exception is caught). No memory corruption and no information leak. CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L = 6.4 (Medium); CWE-770.

console-full.log

link: https://github.com/3em0/cve_repo/blob/main/2026/AUTOMATIC1111_stable-diffusion-webui_v1.10.1_Unbounded_Metadata_Read(CWE-770)in_safetensors_Header_Parsing.md