EUVD-2026-37204Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Triggered by parsing a local attacker-supplied file (AV:L, UI:R), no auth to the library (PR:N), reliable sign-confusion overflow (AC:L), heap RCE gives full CIA (C/I/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. In versions prior to master-584-0a7ae07, the pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the BINUNICODE opcode handler. The issue was caused by sign confusion on the opcode length field. A crafted .ckpt file could trigger memcpy with a very large length derived from a negative signed value, causing immediate heap corruption. The issue has been resolved in version master-584-0a7ae07. If developers are unable to immediately update their applications they can work around this issue by only loading .ckpt checkpoint files from trusted sources and preferring trusted model sources and safer formats such as .safetensors where possible.
AnalysisAI
Heap-based buffer overflow in stable-diffusion.cpp's pickle .ckpt parser allows attackers to corrupt memory and likely achieve code execution when a victim loads a maliciously crafted checkpoint file. The flaw stems from sign confusion in the BINUNICODE opcode length field, causing memcpy to be called with an attacker-controlled, effectively gigantic size derived from a negative signed integer. No public exploit identified at time of analysis, and the issue is fixed in master-584-0a7ae07.
Technical ContextAI
stable-diffusion.cpp is a pure C/C++ inference library for diffusion models (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image) maintained by leejet, identified by CPE cpe:2.3:a:leejet:stable-diffusion.cpp. To remain compatible with the PyTorch ecosystem it implements its own parser for the Python pickle format used inside legacy .ckpt/.pt/.pth checkpoints. Pickle is a stack-based serialization format whose BINUNICODE opcode is followed by a 4-byte little-endian length and that many UTF-8 bytes; the vulnerable handler in src/model.cpp read this length into a signed type, then passed it to memcpy. A length with the high bit set was interpreted as a negative number and, when implicitly converted to the size_t argument of memcpy, became a multi-gigabyte copy into a small heap buffer, classic CWE-122 (heap-based buffer overflow). The upstream fix (PR #1443, commit 0a7ae07) restructures checkpoint loading into separate torch_legacy_io and torch_zip_io modules that replace the old ckpt_io path.
RemediationAI
Vendor-released patch: master-584-0a7ae07 - update stable-diffusion.cpp (and rebuild any embedding application) to this revision or later, per GHSA-mghm-5mqc-pwmp and PR #1443. If immediate upgrade is impossible, the vendor-recommended workaround is to load .ckpt checkpoint files only from trusted sources and to prefer the .safetensors format wherever the model is available, since .safetensors uses a non-executable tensor-only layout that does not exercise the vulnerable pickle parser; the trade-off is that some community models are distributed only as .ckpt and would have to be re-converted or skipped. As additional compensating controls, restrict the directories from which the application reads checkpoints, run inference processes under a low-privilege account with no network egress and with seccomp/AppArmor confinement, and gate uploaded models through a server-side check that rejects pickle-format files, accepting only .safetensors.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today