CVE-2026-47748: stable-diffusion.cpp Buffer Overflow Flaw

CVE-2026-47748 Overview

CVE-2026-47748 affects stable-diffusion.cpp, a pure C/C++ library for running diffusion model inference across Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and related models. Versions prior to master-584-0a7ae07 contain an out-of-bounds read [CWE-125] in the PyTorch checkpoint pickle opcode parser located in src/model.cpp. The parser advances its buffer pointer using buffer += N expressions without verifying that buffer + N <= buffer_end. A malformed or truncated .ckpt file triggers reads past the end of the metadata buffer. LibFuzzer reproduced crashes in under one second using malformed checkpoint inputs.

Critical Impact
Loading an untrusted .ckpt model file causes an out-of-bounds read that crashes the host application, producing a denial-of-service condition for any pipeline consuming community-sourced diffusion checkpoints.

Affected Products

stable-diffusion.cpp versions prior to master-584-0a7ae07
Applications embedding stable-diffusion.cpp to load .ckpt PyTorch checkpoint files
Downstream diffusion model inference tools relying on the legacy pickle .ckpt parser

Discovery Timeline

2026-06-16 - CVE-2026-47748 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47748

Vulnerability Analysis

The flaw resides in the legacy PyTorch checkpoint loader inside src/model.cpp. PyTorch .ckpt files are Python pickle streams containing opcodes that direct an interpreter to push values, build objects, and reference memo slots. The stable-diffusion.cpp parser walks these opcodes manually to extract tensor metadata without invoking the Python runtime.

Throughout the opcode dispatch loop, handlers read fixed-size or length-prefixed arguments and then advance the cursor with statements such as buffer += N. The parser does not consistently verify that buffer + N <= buffer_end before performing the read or the increment. A truncated checkpoint therefore drives the parser to dereference memory beyond the mapped input region.

LibFuzzer reaches crashes in under one second, confirming the bug is trivially reachable through standard mutation-based fuzzing. Exploitation requires the victim application to open a crafted .ckpt file, typically obtained from public model-sharing platforms.

Root Cause

The root cause is missing bounds validation in pickle opcode handlers. Each handler trusts the length encoded in the input or implicit operand size without comparing the projected read against buffer_end. This produces a classic out-of-bounds read pattern characteristic of [CWE-125].

Attack Vector

The attacker publishes a malformed .ckpt file to a model-sharing site or distributes it directly. When a user or automated pipeline loads the file through init_from_ckpt_file, the parser reads past the metadata buffer and the process aborts. The CVSS vector indicates local access with user interaction and high impact to availability only.

// Patch excerpt from src/model.h - upstream fix
 bool init_from_gguf_file(const std::string& file_path, const std::string& prefix = "");
 bool init_from_safetensors_file(const std::string& file_path, const std::string& prefix = "");
-bool init_from_ckpt_file(const std::string& file_path, const std::string& prefix = "");
+bool init_from_torch_zip_file(const std::string& file_path, const std::string& prefix = "");
+bool init_from_torch_legacy_file(const std::string& file_path, const std::string& prefix = "");
 bool init_from_diffusers_file(const std::string& file_path, const std::string& prefix = "");
// Source: https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f

The patch replaces the single permissive init_from_ckpt_file entry point with restricted loaders that separate the zip container path from the legacy pickle path and apply consistent bounds checks.

Detection Methods for CVE-2026-47748

Indicators of Compromise

Process crashes or segmentation faults in applications loading diffusion model checkpoints
.ckpt files originating from untrusted or recently created model-sharing accounts
Checkpoint files with truncated or inconsistent pickle stream sizes relative to declared metadata

Detection Strategies

Inventory build artifacts and container images that link against stable-diffusion.cpp and compare the embedded commit hash against master-584-0a7ae07
Scan ML model repositories and shared storage for .ckpt files and flag any that fail strict pickle validation
Hook crash telemetry from inference services to alert on aborts in the pickle parser code path

Monitoring Recommendations

Capture and centralize core dumps from diffusion inference workers for triage
Log every model-load event with source URL, file hash, and loader function name
Alert on repeated abnormal terminations of processes that perform .ckpt loading

How to Mitigate CVE-2026-47748

Immediate Actions Required

Upgrade stable-diffusion.cpp to commit 0a7ae07 (master-584-0a7ae07) or later
Rebuild and redeploy any downstream binaries, container images, or Python bindings that statically link the affected library
Audit existing .ckpt assets and quarantine files received from unverified contributors

Patch Information

The fix is published in commit 0a7ae07f948eff4611968a65a22bd7c7031ad74f, which introduces restricted torch legacy checkpoint loading. See the GitHub Security Advisory GHSA-rx4w-x86j-vx57 and the upstream commit for full details.

Workarounds

Refuse to load .ckpt files from untrusted sources until the patched version is deployed
Prefer .safetensors checkpoints, which do not invoke pickle parsing
Restrict checkpoint ingestion to an allowlist of trusted publishers and verified file hashes

bash

# Pin stable-diffusion.cpp to the patched commit during build
git clone https://github.com/leejet/stable-diffusion.cpp.git
cd stable-diffusion.cpp
git checkout 0a7ae07f948eff4611968a65a22bd7c7031ad74f
cmake -B build && cmake --build build --config Release

# Prefer safetensors over legacy ckpt at runtime
./build/bin/sd --model /models/checkpoint.safetensors --prompt "..."