Executive Summary

CVE-2026-47748 is a vulnerability in the stable-diffusion.cpp library, which is used for running diffusion models like Stable Diffusion. The issue arises from an out-of-bounds read error in the PyTorch checkpoint (.ckpt) pickle opcode parser located in src/model.cpp. Specifically, the parser does not consistently check if there is enough input data before reading opcode arguments or advancing the parser buffer. This means that a crafted or truncated .ckpt file can cause the parser to read beyond the end of the metadata buffer, potentially leading to crashes.

The vulnerability is triggered when an application loads a malicious or malformed .ckpt file from an untrusted source. The problem was discovered through fuzz testing, which caused crashes within seconds. The issue has been fixed in version master-584-0a7ae07 by refactoring checkpoint loading to restrict legacy PyTorch checkpoint support and adding proper checks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing denial of service (DoS) in applications that use affected versions of stable-diffusion.cpp to load .ckpt model files from untrusted sources. A maliciously crafted or truncated checkpoint file can trigger out-of-bounds reads, leading to application crashes.

The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a model downloaded from a sharing site. If exploited, it can disrupt availability by crashing the process handling the model loading.

To mitigate the impact, developers should update to the fixed version (master-584-0a7ae07 or later), avoid loading .ckpt files from untrusted sources, and prefer safer formats like .safetensors.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as out-of-bounds reads causing crashes when loading malformed or truncated .ckpt checkpoint files using the stable-diffusion.cpp library. Detection involves monitoring for application crashes or abnormal behavior when loading .ckpt files.

Since the issue is triggered by loading crafted or truncated .ckpt files, you can detect attempts by checking logs or monitoring processes that load such files.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should avoid loading .ckpt checkpoint files from untrusted sources.

Prefer using safer model formats such as .safetensors whenever possible.

Upgrade to the patched version of stable-diffusion.cpp, specifically version master-584-0a7ae07 or later, which includes fixes restricting legacy checkpoint loading and adds error handling.

Useful 0 Not Useful 0