By vendor

Leejet vulnerabilities

Known CVEs affecting Leejet products, prioritized by severity, with SEC.co remediation and detection guidance.

4 published vulnerabilities

• CVE-2026-47747HIGH 7.8

  stable-diffusion.cpp, a C/C++ library for running inference on diffusion models like Stable Diffusion and Flux, contains a memory safety flaw in its checkpoint file parser. When processing .ckpt model files, a sign-confusion bug in the BINUNICODE opcode handler causes the parser to interpret a negative length value as an extremely large positive number, triggering an out-of-bounds memory copy that corrupts the heap. An attacker who controls a .ckpt file can exploit this to crash applications or potentially execute arbitrary code. The vulnerability affects versions prior to master-584-0a7ae07.

• CVE-2026-47749HIGH 7.8

  A flaw in stable-diffusion.cpp allows an attacker to corrupt the memory of applications that load malicious model checkpoint files (.ckpt format). The vulnerability exists in how the library parses PyTorch checkpoint files—specifically in the SHORT_BINUNICODE opcode handler. An improperly crafted .ckpt file can exploit a sign-handling bug to trigger an oversized memory copy operation, immediately corrupting the application's heap. If you use stable-diffusion.cpp to load model files from untrusted sources (like public model repositories), a crafted file could crash your application or potentially enable code execution. The risk is local and requires user interaction to load a malicious file.

• CVE-2026-47750HIGH 7.8

  stable-diffusion.cpp, a C/C++ library for running AI image generation models locally, contains a critical flaw in how it parses checkpoint (.ckpt) files. When processing a specially crafted malicious .ckpt file, the parser can fail to validate the expected structure, causing it to write beyond allocated memory boundaries. An attacker could exploit this by distributing a poisoned model file through public model-sharing platforms, tricking users or applications into loading it. Once loaded, the memory corruption could lead to a complete system compromise—data theft, unauthorized changes, or denial of service. The vulnerability requires user interaction (loading the file) but no special privileges to trigger.

• CVE-2026-47748MEDIUM 5.5

  A flaw in stable-diffusion.cpp allows attackers to crash applications or potentially read sensitive memory by providing a malformed or intentionally truncated model checkpoint (.ckpt) file. The vulnerability exists in how the library parses PyTorch checkpoint files—it fails to validate that sufficient data remains before reading, so a crafted file can cause the parser to read past the end of its buffer. An attacker would need to trick a user or application into loading a malicious .ckpt file, typically from an untrusted model repository. The practical risk is limited to environments that load external model files, but the impact on those systems can be significant.