CVE-2026-47749
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The stable-diffusion.cpp library has a heap buffer overflow vulnerability in the SHORT_BINUNICODE handler when parsing PyTorch checkpoint files. Versions prior to master-584-0a7ae07 are susceptible to attacks that may lead to heap corruption and potential code execution.
Risk Assessment
Organizations using vulnerable versions may face process crashes and the possibility of executing malicious code if they load .ckpt files from untrusted sources.
Recommendation
It is recommended to upgrade to version master-584-0a7ae07 or avoid loading .ckpt files from untrusted sources, and to refer to trusted model sources and safer formats like .safetensors.
Other vulnerabilities in stable-diffusion.cpp
See all- CVE-2026-47750High
The stable-diffusion.cpp library has a heap buffer overflow vulnerability in the GLOBAL opcode handler in the .ckpt parser, which can lead to memory corruption. This issue affects versions prior to master-584-0a7ae07 and is caused by missing validation when searching for newline-delimited fields.
- CVE-2026-47747High
The stable-diffusion.cpp library has a heap buffer overflow vulnerability in the BINUNICODE opcode handler in the .ckpt parser, which can lead to memory corruption. This issue affects versions prior to master-584-0a7ae07.
- CVE-2026-47748Medium
The stable-diffusion.cpp library, used for running diffusion models, has a vulnerability to an out-of-bounds read error in versions prior to master-584-0a7ae07. This issue arises from improper length checks during .ckpt file parsing, which can lead to reads past the end of the metadata buffer.
Original NVD description (English source)
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to heap buffer overflow in SHORT_BINUNICODE parsing for PyTorch checkpoint files. The pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the SHORT_BINUNICODE opcode handler. The issue was caused by sign confusion on the opcode length field. A crafted .ckpt file could trigger memcpy with a very large length derived from a negative signed value, causing immediate heap corruption. Any application using affected stable-diffusion.cpp releases to load untrusted .ckpt model files could be vulnerable. A malicious checkpoint file could cause heap corruption through memcpy with an attacker-controlled length. This may lead to process crash and could potentially be leveraged for code execution depending on heap layout. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. The issue has been resolved in version master-584-0a7ae07. If developers are unable to immediately update their applications they can work around this issue by not loading .ckpt checkpoint files from untrusted sources, and referring to trusted model sources and safer formats such as .safetensors where possible.