Executive brief
stable-diffusion.cpp is a software library used to run artificial intelligence image generation models. A security flaw allows a specially crafted or corrupted model file to crash the application when it is loaded. This could be used by an attacker to disrupt services or cause applications to fail if they process untrusted model files downloaded from the internet.
Technical details
An out-of-bounds read vulnerability exists in the pickle .ckpt parser within src/model.cpp of stable-diffusion.cpp. The root cause is a failure to validate buffer boundaries; opcode handlers increment the parser position (e.g., buffer += N) without verifying that the new position remains within the allocated metadata buffer. An attacker can exploit this by providing a truncated or malformed PyTorch checkpoint file, leading to a denial-of-service (crash) via an out-of-bounds read. This issue is triggered when an application attempts to load a malicious model file. The vulnerability has been addressed in version master-584-0a7ae07 by implementing restricted checkpoint loading.
Affected products
- leejet stable-diffusion.cpp < master-584-0a7ae07
Timeline
- 2026-04-19: patched: Fix committed to repository
- 2026-05-22: advisory: GitHub Security Advisory published
- 2026-06-16: disclosed: CVE published to NVD