CVE-2026-47750: Heap Buffer Overflow in stable-diffusion.cpp .ckpt Parser

Technical summary

The vulnerability exists in the GLOBAL opcode handler within the pickle .ckpt parser located in src/model.cpp. The root cause is insufficient validation of newline-delimited fields during parsing. When a .ckpt file lacks the expected newline delimiter, the search logic returns -1, which is then passed as a copy length to a memory operation, causing heap buffer overflow. This type of memory corruption can be leveraged to read or write arbitrary data on the affected system. The flaw was patched in commit master-584-0a7ae07, which presumably adds proper bounds checking and validation logic to handle malformed input gracefully.

Business impact

Organizations and individuals using stable-diffusion.cpp for local model inference face significant operational risk. Compromised machine learning pipelines could leak proprietary training data or inference results, corrupt generated outputs, or disable services entirely. Supply chain risk is notable: model-sharing communities (Hugging Face, GitHub, etc.) are common attack distribution vectors. If your application automatically fetches or accepts user-uploaded models without sandboxing, the blast radius extends to end users. For enterprises embedding this library into products, patch delays translate to customer vulnerability windows and potential breach notifications.

Affected systems

All versions of stable-diffusion.cpp prior to master-584-0a7ae07 are vulnerable. The library itself is open-source and lightweight, so exposure depends on downstream adoption: command-line tools, web applications, desktop software, and embedded systems using this library are all at risk. The attack surface is specifically when loading .ckpt format checkpoints; other formats like .safetensors are not affected by this particular vulnerability. Verify your application's pinned version against the fixed commit hash provided by the maintainer.

Exploitability

Exploitation requires two conditions: (1) the vulnerable code must be active and used to parse .ckpt files, and (2) a user or automated system must be convinced to load a malicious .ckpt file. This is a realistic attack in open-source AI communities where models are freely shared. No network component is needed; the attack is entirely local to the parsing process. Exploit complexity is relatively low for a skilled attacker who understands pickle format semantics. The CVSS score of 7.8 (HIGH) reflects the memory corruption severity and local-execution barrier; it is not currently tracked as actively exploited in the wild.

Remediation

Immediate action: upgrade stable-diffusion.cpp to version master-584-0a7ae07 or later. If immediate patching is infeasible, implement application-level mitigations: (1) restrict .ckpt file loading to trusted, cryptographically verified sources only; (2) migrate to the safer .safetensors format, which does not have this parser vulnerability; (3) run model loading in a sandboxed environment (container, VM, or isolated user account) to limit blast radius; (4) disable automatic model downloads or implement human review workflows.

Patch guidance

Consult the stable-diffusion.cpp project repository (github.com/leejet/stable-diffusion.cpp) for the specific commit master-584-0a7ae07 and release notes. Apply the patch by updating your dependency to the fixed version or building from the patched commit. Developers should audit any local modifications to src/model.cpp that may conflict with the patch. After patching, validate that your application continues to parse .ckpt files correctly by testing against known good models. Consider adopting .safetensors as the default checkpoint format going forward.

Detection guidance

Monitor for unusual crashes or memory access violations when loading .ckpt files, particularly if error logs show segmentation faults or heap corruption messages. If you cannot immediately patch, implement a validation step before parsing: scan incoming .ckpt files for proper pickle opcode formatting and presence of expected delimiters. In production, enable address sanitizer (ASAN) or similar memory safety tooling during testing to catch heap overflow attempts. Log all .ckpt file sources and sha256 hashes; compare against known-good model checksums to detect tampering.

Why prioritize this

This vulnerability warrants HIGH priority for any team using stable-diffusion.cpp in production or accepting external model files. The combination of high CVSS (7.8), reliable exploitability via file distribution, and severe consequence (memory corruption leading to RCE or data exfiltration) creates substantial risk. Organizations in regulated industries or handling sensitive training data should prioritize patching within one business day. The current lack of known public exploits is not a reason for delay; the exploit is trivial for motivated attackers familiar with pickle format internals.

Risk score, explained

CVSS 7.8 (HIGH) is justified by: Attack Vector Local (AV:L) — the file must be parsed locally, but no prior system compromise is needed; Attack Complexity Low (AC:L) — any .ckpt file missing a newline can trigger it; Privileges Required None (PR:N); User Interaction Required (UI:R) — user must load the file, but malware or deceptive UX can facilitate this; Scope Unchanged (S:U); Confidentiality High (C:H), Integrity High (I:H), Availability High (A:H) — heap overflow can read, modify, or crash the process. The score does not account for active exploitation or KEV listing, which remain absent as of the publication date.

Frequently asked questions