CVE-2026-47749: stable-diffusion.cpp Buffer Overflow Flaw

CVE-2026-47749 Overview

CVE-2026-47749 is a heap buffer overflow vulnerability in stable-diffusion.cpp, a pure C/C++ library for running diffusion model inference. The flaw resides in the pickle .ckpt parser inside src/model.cpp, specifically within the SHORT_BINUNICODE opcode handler. A sign confusion bug on the opcode length field allows a crafted PyTorch checkpoint file to trigger a memcpy call with an attacker-controlled, oversized length. Loading a malicious .ckpt model file leads to immediate heap corruption. The issue affects all versions prior to master-584-0a7ae07.

Critical Impact
A malicious .ckpt checkpoint can corrupt the heap and may be leveraged for arbitrary code execution in any application that loads untrusted Stable Diffusion model files.

Affected Products

stable-diffusion.cpp versions prior to master-584-0a7ae07
Applications embedding stable-diffusion.cpp for PyTorch .ckpt loading
Downstream diffusion model runtimes built on the affected releases

Discovery Timeline

2026-06-16 - CVE-2026-47749 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47749

Vulnerability Analysis

The vulnerability is a heap buffer overflow [CWE-122] in the pickle deserialization routine used to parse PyTorch .ckpt checkpoint files. The PyTorch checkpoint format wraps tensor data in a Python pickle stream, and stable-diffusion.cpp implements a minimal pickle interpreter inside src/model.cpp to extract tensor metadata. The SHORT_BINUNICODE opcode reads a length-prefixed UTF-8 string, but the parser treats the single-byte length field as a signed value before passing it to a memcpy. When the length is interpreted as a large unsigned value through integer promotion, memcpy writes far beyond the allocated heap buffer.

The practical impact ranges from process crash to potential code execution. Because the overflow length is attacker-controlled and the corruption occurs on the heap, exploitation depends on the surrounding heap layout and allocator behavior of the host application.

Root Cause

The root cause is sign confusion on the SHORT_BINUNICODE opcode length byte. The parser stores the length in a signed integer type, and any byte with the high bit set is sign-extended to a negative value. When that value is subsequently used as the size_t argument to memcpy, it converts to a near-maximum unsigned integer, producing an out-of-bounds write into the heap-allocated destination buffer.

Attack Vector

Exploitation requires a victim or application to load a crafted .ckpt file from an untrusted source, such as a community model sharing site. No network access to the target is required and no privileges are needed, but user interaction in the form of loading the model file is necessary. The malicious checkpoint embeds a SHORT_BINUNICODE opcode with a length byte greater than 0x7F, triggering the overflow during parsing before any tensor data is processed. See the GitHub Security Advisory GHSA-2c29-5hxg-fv9g for the technical write-up.

Detection Methods for CVE-2026-47749

Indicators of Compromise

Unexpected crashes or segmentation faults in processes that load .ckpt files via stable-diffusion.cpp
.ckpt files sourced from public model-sharing platforms with anomalous file sizes or non-standard pickle opcode sequences
Heap corruption signatures in core dumps referencing the pickle parsing path in src/model.cpp

Detection Strategies

Inventory all binaries and containers that statically or dynamically link stable-diffusion.cpp and identify versions prior to master-584-0a7ae07
Scan .ckpt files at ingestion for SHORT_BINUNICODE opcodes (0x8C) followed by length bytes with the high bit set
Run the host application under AddressSanitizer or a hardened allocator in test environments to surface heap overflows during checkpoint loading

Monitoring Recommendations

Alert on crashes of processes that load model files, especially those originating from user-supplied paths or downloaded artifacts
Track outbound downloads of .ckpt files from non-allowlisted model repositories
Log and review model file hashes loaded by inference workloads to enable post-incident triage

How to Mitigate CVE-2026-47749

Immediate Actions Required

Upgrade stable-diffusion.cpp to version master-584-0a7ae07 or later across all build pipelines and deployed binaries
Quarantine .ckpt files obtained from untrusted or community sources until they can be validated
Audit downstream applications that embed stable-diffusion.cpp and rebuild them against the patched library

Patch Information

The issue is resolved in master-584-0a7ae07. The fix corrects the sign handling on the SHORT_BINUNICODE length field so the value is treated as unsigned before being passed to memcpy. Patch details are available in the GitHub Commit Update and the corresponding GitHub Pull Request #1443.

Workarounds

Do not load .ckpt checkpoint files from untrusted sources; restrict ingestion to vetted, internal model registries
Prefer the .safetensors format, which does not rely on pickle deserialization and avoids this class of parser bug
Isolate model-loading processes in sandboxed environments or containers with restricted filesystem and network access

bash

# Configuration example: restrict checkpoint loading to .safetensors and verified sources
find ./models -type f -name '*.ckpt' -exec sha256sum {} \; > model_inventory.txt
# Compare against an allowlist of trusted hashes before loading
grep -F -f trusted_hashes.txt model_inventory.txt > approved_models.txt