CVE-2026-47750: stable-diffusion.cpp Buffer Overflow

CVE-2026-47750 Overview

CVE-2026-47750 is a heap buffer overflow vulnerability in stable-diffusion.cpp, a pure C/C++ library used for running diffusion model inference. The flaw resides in the pickle .ckpt parser within src/model.cpp, specifically in the GLOBAL opcode handler. A crafted checkpoint file missing the expected newline delimiter causes the parser to compute a copy length of -1, leading to immediate heap corruption. Exploitation requires a user or application to load a malicious .ckpt file from an untrusted source, such as a public model sharing site. The issue is fixed in version master-584-0a7ae07. The weakness is tracked as [CWE-787] Out-of-Bounds Write.

Critical Impact
Loading an attacker-supplied .ckpt model file triggers heap corruption that can lead to arbitrary code execution in the host process.

Affected Products

stable-diffusion.cpp versions prior to master-584-0a7ae07
Applications and AI inference pipelines that embed the affected library
Downstream tools that load legacy PyTorch .ckpt checkpoint files via stable-diffusion.cpp

Discovery Timeline

2026-06-16 - CVE-2026-47750 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47750

Vulnerability Analysis

The vulnerability lives in the legacy PyTorch pickle deserialization path used to load .ckpt checkpoints. When parsing a GLOBAL opcode, the parser scans for newline-delimited fields that identify the Python module and class name. The code did not validate that a terminating newline was actually present in the input.

When the search routine fails to find a newline, it returns a sentinel value that is later used directly as a length argument for a copy operation. Interpreting -1 as an unsigned length produces a value of SIZE_MAX, causing the subsequent memory copy to overflow the destination heap buffer and corrupt adjacent heap metadata.

The CWE classification is [CWE-787] Out-of-Bounds Write. Because pickle deserialization runs early in checkpoint loading, the corruption occurs before any model data is validated, giving an attacker control over the process state at a sensitive point in execution.

Root Cause

The root cause is missing input validation in the GLOBAL opcode handler in src/model.cpp. The handler trusts that .ckpt content follows the expected pickle grammar and does not check the return value of the newline search before passing it as a copy length. Any .ckpt file lacking the expected \n delimiter triggers the bug.

Attack Vector

Exploitation requires a local user to load a malicious .ckpt file, mirroring how diffusion model checkpoints are routinely downloaded from community model repositories. User interaction is required, but the social context of model sharing makes delivery straightforward. A successful attack can yield heap corruption suitable for arbitrary code execution under the privileges of the loading process.

// Patch excerpt from src/model.h - the legacy .ckpt loader was split
// into separate, restricted torch zip and torch legacy paths.
bool init_from_gguf_file(const std::string& file_path, const std::string& prefix = "");
bool init_from_safetensors_file(const std::string& file_path, const std::string& prefix = "");
-bool init_from_ckpt_file(const std::string& file_path, const std::string& prefix = "");
+bool init_from_torch_zip_file(const std::string& file_path, const std::string& prefix = "");
+bool init_from_torch_legacy_file(const std::string& file_path, const std::string& prefix = "");
bool init_from_diffusers_file(const std::string& file_path, const std::string& prefix = "");

Source: GitHub Commit 0a7ae07

Detection Methods for CVE-2026-47750

Indicators of Compromise

Unexpected process crashes, SIGSEGV signals, or glibc heap corruption messages from applications that loaded a .ckpt file.
Presence of .ckpt files from untrusted or unverified model repositories on developer or inference hosts.
Child processes or outbound network connections spawned by inference processes shortly after a checkpoint load.

Detection Strategies

Inventory builds and containers that link against stable-diffusion.cpp and flag versions older than master-584-0a7ae07.
Hash and catalog all .ckpt files on inference systems and compare against known-good vendor hashes.
Run inference processes under sandboxing or seccomp profiles so anomalous syscalls during checkpoint parsing become observable.

Monitoring Recommendations

Alert on process crashes or abort signals originating from AI/ML inference workloads.
Monitor download activity to model storage paths and record the source URL of every .ckpt artifact.
Track execve, network egress, and file write events spawned by processes that invoke pickle deserialization.

How to Mitigate CVE-2026-47750

Immediate Actions Required

Upgrade stable-diffusion.cpp to commit 0a7ae07 (master-584-0a7ae07) or later in all build pipelines and container images.
Audit existing .ckpt files and remove any obtained from untrusted or unverified sources.
Migrate workflows to .safetensors format wherever the model is available in that format.

Patch Information

The fix is committed in GitHub Commit 0a7ae07 and merged via GitHub Pull Request #1443. The legacy init_from_ckpt_file path was replaced with restricted init_from_torch_zip_file and init_from_torch_legacy_file loaders that validate pickle input. Full details are documented in GitHub Security Advisory GHSA-v37x-jwp7-mcvc.

Workarounds

Do not load .ckpt checkpoint files from untrusted sources.
Restrict checkpoint loading to vetted, trusted model providers with verified hashes.
Prefer the .safetensors format, which does not execute pickle opcodes.
Run inference workloads in isolated containers or sandboxes with restricted filesystem and network access.

bash

# Pin to the patched release in your build pipeline
git clone https://github.com/leejet/stable-diffusion.cpp.git
cd stable-diffusion.cpp
git checkout 0a7ae07f948eff4611968a65a22bd7c7031ad74f

# Prefer .safetensors over .ckpt when invoking the CLI
./sd --model /models/trusted-model.safetensors \
     --prompt "a photo of a cat" \
     --output out.png