CVE-2026-47747: stable-diffusion.cpp Heap Buffer Overflow in .ckpt Parser

Technical summary

The vulnerability exists in src/model.cpp's pickle opcode parser, specifically in the BINUNICODE handler used to deserialize .ckpt checkpoint files. The root cause is a sign-confusion error on the opcode length field: a signed integer is cast or used in a context expecting an unsigned value. When a negative length is interpreted as unsigned, memcpy receives a very large size parameter, writing beyond allocated heap boundaries. This violates CWE-787 (out-of-bounds write) and CWE-122 (heap-based buffer overflow). The condition requires user interaction (loading a crafted .ckpt file) and local access, but no special privileges are needed.

Business impact

Organizations embedding stable-diffusion.cpp in AI/ML applications face denial-of-service risk if they load untrusted model checkpoint files—a common occurrence in open-model-sharing scenarios. Heap corruption can cause unpredictable crashes, degrading service availability. In worst-case scenarios, exploitation could enable code execution within the process context, potentially compromising the host system if the application runs with elevated privileges or processes sensitive data. Teams relying on community-sourced or third-party checkpoints without validation are at elevated risk.

Affected systems

Any application or service using leejet/stable-diffusion.cpp versions prior to master-584-0a7ae07 and loading .ckpt checkpoint files is affected. This includes AI inference services, machine-learning pipelines, and tools that allow users to supply custom model files. The vulnerability does not affect .safetensors or other non-pickle-based model formats.

Exploitability

Exploitation requires an attacker to craft a malicious .ckpt file and trick or convince a user to load it into an application using the vulnerable library. There is no remote attack vector; the vulnerability is local and requires user interaction. The low barrier to crafting a malicious .ckpt file (modifying the opcode length field) and the prevalence of model-sharing practices make exploitation feasible in open-ecosystem environments. Public exploit code has not been reported.

Remediation

Update stable-diffusion.cpp to version master-584-0a7ae07 or later. If immediate updating is not feasible, restrict .ckpt file loading to trusted, internally controlled sources and encourage migration to safer formats like .safetensors. Implement file validation or sandboxing if loading user-supplied checkpoints is unavoidable. Code review of pickle deserialization in custom integrations is recommended.

Patch guidance

Upgrade to master-584-0a7ae07 or the latest stable release of leejet/stable-diffusion.cpp from the project's repository. Verify the commit hash in your build environment. If using a stable release tag, check the project's release notes to confirm the fix is included. Test model inference with your existing .ckpt files before full production rollout to ensure compatibility.

Detection guidance

Monitor for unexpected heap-corruption or segmentation-fault crashes when loading .ckpt files, particularly from external sources. In debug builds, heap sanitizers (e.g., AddressSanitizer) will immediately flag the overflow. Audit application logs for failures during model initialization. If you control model distribution, validate checkpoint files before deployment and prefer distributing models in .safetensors format. Network-level detection is not applicable since the exploit is file-based.

Why prioritize this

This vulnerability merits prompt remediation due to its HIGH CVSS score (7.8), the ease of crafting a malicious payload, and the prevalence of model-sharing in AI/ML workflows. While exploitation requires local access and user interaction, the potential for code execution and the minimal attack preparation effort elevate the risk. Organizations with open model-loading pipelines should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (low scope but no remote exposure); low attack complexity (straightforward opcode manipulation); no privilege elevation required; user interaction needed (model loading); and high impact (heap corruption enables confidentiality, integrity, and availability violations). The score appropriately captures the severity of heap overflow in a widely-used ML library, despite the local-access requirement.

Frequently asked questions