leejet stable-diffusion.cpp Pickle Parser out-of-bounds

Summaryinfo

A vulnerability categorized as problematic has been discovered in leejet stable-diffusion.cpp. Affected by this issue is some unknown functionality of the file stable-diffusion.cpp of the component Pickle Parser. Such manipulation leads to out-of-bounds. This vulnerability is uniquely identified as CVE-2026-47748. Local access is required to approach this attack. No exploit exists. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in leejet stable-diffusion.cpp (affected version unknown) and classified as problematic. Affected by this issue is an unknown functionality of the file stable-diffusion.cpp of the component Pickle Parser. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is availability. CVE summarizes:

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to an out-of-bounds reads error through PyTorch checkpoint pickle opcode parsing. The pickle .ckpt parser in src/model.cpp did not consistently check that enough input remained before reading opcode arguments or advancing the parser buffer with a crafted or truncated .ckpt file. Throughout the pickle parser, opcode handlers advanced the parser position with expressions such as buffer += N without first checking that buffer + N <= buffer_end. A truncated file could therefore cause reads past the end of the metadata buffer. LibFuzzer found crashes in under one second using malformed checkpoint inputs. Any application using affected stable-diffusion.cpp releases to load untrusted .ckpt model files could be vulnerable. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. This issue has been fixed in version master-584-0a7ae07. If developers are unable to immediately update their applications, they can work around this issue by ensuring they do not load .ckpt checkpoint files from untrusted sources. They should prefer trusted model sources and safer formats such as .safetensors where possible.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-47748 since 05/20/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Applying the patch 0a7ae07f948eff4611968a65a22bd7c7031ad74f is able to eliminate this problem. The bugfix is ready for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• leejet

Name

• stable-diffusion.cpp

License

• open-source

Website

• Product: https://github.com/leejet/stable-diffusion.cpp/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion