Executive brief
stable-diffusion.cpp is a library used to run AI image generation models. A security flaw allows a malicious model file to crash the application or potentially take control of the computer when the file is opened. Users should only load model files from trusted sources and update to the latest version of the software.
Technical details
A heap-based buffer overflow exists in the SHORT_BINUNICODE opcode handler within the pickle .ckpt parser in src/model.cpp. The vulnerability is caused by sign confusion where a one-byte length field is read as a signed 8-bit integer (int8_t). An attacker can provide a value such as 0xFF, which is interpreted as -1, bypassing length checks (e.g., -1 < 512) before being passed to memcpy as a size_t. This results in a massive memory copy (SIZE_MAX), leading to immediate heap corruption. Exploitation requires a user to load a specially crafted .ckpt file. The issue is fixed in version master-584-0a7ae07.
Affected products
- leejet stable-diffusion.cpp prior to master-584-0a7ae07
Timeline
- 2026-04-19: patched: Fix committed in master-584-0a7ae07
- 2026-05-22: advisory: GitHub Security Advisory published
- 2026-06-16: disclosed: CVE-2026-47749 published to NVD