CVE-2026-47748: Out-of-Bounds Read in stable-diffusion.cpp Checkpoint Parser

Technical summary

The pickle parser in src/model.cpp of stable-diffusion.cpp performs buffer arithmetic without bounds checking. Specifically, opcode handlers advance the parser position using expressions like buffer += N without first validating that buffer + N remains within buffer_end. When a truncated or malformed .ckpt file is parsed, this leads to out-of-bounds reads (CWE-125). LibFuzzer discovered crashes in under one second using malformed inputs, demonstrating the ease of triggering the condition. The library supports inference for Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and other diffusion models. Versions prior to master-584-0a7ae07 are affected.

Business impact

Applications embedding stable-diffusion.cpp for local model inference face a denial-of-service risk if they accept model files from external sources—such as public model-sharing platforms (Hugging Face, Civitai, etc.) or user uploads. A crash could interrupt AI pipelines, disrupt services, or in multi-tenant environments, cause collateral impact to other workloads. Information disclosure risk is lower but non-zero; memory reads could theoretically leak sensitive data if the application or system holds secrets in memory. Organizations running stable-diffusion.cpp in production should prioritize assessment of their model-loading workflow and trust boundaries.

Affected systems

Any application or service using stable-diffusion.cpp versions prior to master-584-0a7ae07 is potentially affected, provided it loads .ckpt checkpoint files. This primarily impacts: (1) AI/ML applications performing local diffusion model inference; (2) image generation services or plugins that accept user-provided or downloaded models; (3) development and research environments using stable-diffusion.cpp for prototyping. Systems that load only internally vetted, pre-distributed model files face significantly lower risk. The vulnerability does not affect applications using .safetensors or other non-pickle-based model formats.

Exploitability

Exploitation requires user interaction or social engineering. An attacker must convince a user or automated system to load a malicious .ckpt file, typically by hosting it on a model repository or social-engineering a direct file transfer. The attack surface is broad if the application accepts model uploads or downloads from public sources; it is narrow if models are curated internally. Once a malicious file is loaded, the crash is nearly guaranteed and immediate (fuzzing confirmed sub-second discovery). Remote code execution is not indicated by this vulnerability; the impact is limited to denial of service and potential information disclosure through memory reads.

Remediation

Update stable-diffusion.cpp to version master-584-0a7ae07 or later. For organizations unable to update immediately, implement compensating controls: restrict .ckpt file loading to trusted, internally vetted sources; prefer .safetensors format where available; run inference in sandboxed or isolated processes to limit blast radius of a crash; validate file integrity and provenance before loading. End users should avoid downloading models from untrusted sources and report suspicious files to model repository maintainers.

Patch guidance

Consult the leejet stable-diffusion.cpp repository for commit master-584-0a7ae07 and merge into your dependency. Verify that your build system correctly incorporates the updated src/model.cpp with bounds-checking logic in all pickle opcode handlers. Test with your application's existing model file collection to ensure compatibility. If using stable-diffusion.cpp as a library in another project, update the library version and rebuild dependent code.

Detection guidance

Monitor for crashes or segmentation faults in applications using stable-diffusion.cpp, particularly when loading .ckpt files from external or user-controlled sources. Log all model file load attempts and validate file headers and metadata before parsing. Implement fuzz testing in your CI/CD pipeline for any model-loading code path. Use memory sanitizers (ASAN, MSAN) during development and testing to surface out-of-bounds access earlier. In production, enable core dumps or crash reporting to investigate failures post-incident.

Why prioritize this

This is a medium-severity vulnerability (CVSS 5.5) because it requires user interaction and affects the availability of the application rather than enabling remote code execution or widespread data exfiltration. However, it should not be dismissed: any service accepting external model files faces genuine risk. Prioritize patching if your application downloads or allows uploads of .ckpt files. For isolated research or development environments using only curated models, risk is lower but mitigation is still recommended.

Risk score, explained

CVSS 3.1 score of 5.5 (Medium) reflects: (1) low attack vector (local file load, user interaction required); (2) low complexity (malformed file triggers crash consistently); (3) no privilege escalation needed; (4) no confidentiality or integrity impact in the typical case; (5) high availability impact (denial of service via crash). The score does not account for downstream business context—organizations relying on continuous model inference may assign higher internal risk.

Frequently asked questions