CVE-2026-47749: Heap Buffer Overflow in stable-diffusion.cpp Checkpoint Parser

Technical summary

The vulnerability is a heap buffer overflow (CWE-122, CWE-787) in the pickle checkpoint parser within src/model.cpp. The SHORT_BINUNICODE opcode handler mishandles the length field due to sign confusion—a negative signed value is treated as a very large unsigned length in a memcpy call. When processing a malicious .ckpt file, this causes memcpy to write far beyond the allocated buffer, immediately corrupting heap metadata and neighboring allocations. The flaw affects all versions of stable-diffusion.cpp prior to commit master-584-0a7ae07, which patched the sign-handling logic in the opcode parser.

Business impact

Organizations and developers using stable-diffusion.cpp in production pipelines face potential service disruption if a malicious model file is loaded, resulting in application crash or undefined behavior. The vulnerability could compromise systems where model inference is critical—such as AI/ML platforms that accept user-uploaded models or integrate with public model repositories. While the likelihood of exploitation depends on source control over model files, teams that cannot fully vet third-party models face elevated risk. Remediation requires updating to a patched version or restricting model sources and formats.

Affected systems

Any application or service built on stable-diffusion.cpp versions prior to master-584-0a7ae07 is affected when processing .ckpt checkpoint files. The library is used to run inference on Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and similar diffusion models. Exposure is highest in systems that load models from untrusted sources, such as Hugging Face, CivitAI, or user-uploaded repositories, or in automated pipelines that do not validate model file integrity.

Exploitability

Exploitation requires local access and user interaction—the victim or application must load a .ckpt file from an untrusted source. There is no network attack vector. The barrier to exploitation is low for an attacker who can distribute a malicious model file through public channels; however, defense-in-depth practices (model whitelisting, format restrictions, sandboxing) can significantly reduce practical risk. The CVSS score of 7.8 (HIGH) reflects the ease of triggering the crash and the potential for code execution given favorable heap conditions, though code execution is not guaranteed.

Remediation

Developers should immediately upgrade stable-diffusion.cpp to version master-584-0a7ae07 or later. If immediate patching is not feasible, restrict model loading to trusted, curated sources and prefer safer checkpoint formats such as .safetensors, which do not use the vulnerable pickle parser. Implement input validation and consider sandboxing model inference to limit blast radius if a malicious file is inadvertently loaded.

Patch guidance

Update stable-diffusion.cpp to commit master-584-0a7ae07 or any subsequent release that includes the fix. Verify the fix by reviewing the src/model.cpp changes in the opcode handler for SHORT_BINUNICODE to confirm the sign confusion has been corrected. If you maintain a fork or vendor the library, audit the pickle parser logic and rebuild affected applications. Test patched versions against your existing model library to ensure compatibility, particularly if you rely on older .ckpt files.

Detection guidance

Monitor application logs and crash dumps for heap corruption or segmentation faults during model loading. Intrusion detection can flag attempts to distribute .ckpt files with malformed SHORT_BINUNICODE opcodes; however, detection in transit is difficult without deep pickle parsing. More practical: audit model repositories and sources used by your infrastructure, implement file integrity checks on downloaded models, and log model file origins and hashes. Runtime Address Sanitizer (ASAN) or Valgrind can detect the overflow during testing of untrusted models in isolated environments.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH severity, local exploitability, and potential for immediate impact (crash or code execution). While it requires user interaction and local access, the widespread adoption of stable-diffusion.cpp in research and production ML pipelines, combined with the ease of distributing malicious models online, makes it a credible risk. Organizations that load models from public sources should prioritize patching. Those with strict model governance can deprioritize slightly but should still update within their normal patch cycle.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects: (1) local attack vector with no network component; (2) low complexity—a crafted .ckpt file is straightforward to create; (3) no privilege escalation required; (4) user interaction needed (file must be loaded); (5) high confidentiality, integrity, and availability impact if heap corruption occurs. The score is tempered by the requirement for local access and user action, but elevated by the potential for code execution and the ease of distributing malicious models in public repositories.

Frequently asked questions