EUVD-2026-37137Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Upgraded C from N to L because CWE-125 OOB reads in C/C++ can expose adjacent memory, conflicting with the 'Information Disclosure' tag; all other metrics align with the official vector.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to an out-of-bounds reads error through PyTorch checkpoint pickle opcode parsing. The pickle .ckpt parser in src/model.cpp did not consistently check that enough input remained before reading opcode arguments or advancing the parser buffer with a crafted or truncated .ckpt file. Throughout the pickle parser, opcode handlers advanced the parser position with expressions such as buffer += N without first checking that buffer + N <= buffer_end. A truncated file could therefore cause reads past the end of the metadata buffer. LibFuzzer found crashes in under one second using malformed checkpoint inputs. Any application using affected stable-diffusion.cpp releases to load untrusted .ckpt model files could be vulnerable. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. This issue has been fixed in version master-584-0a7ae07. If developers are unable to immediately update their applications, they can work around this issue by ensuring they do not load .ckpt checkpoint files from untrusted sources. They should prefer trusted model sources and safer formats such as .safetensors where possible.
AnalysisAI
Out-of-bounds reads in stable-diffusion.cpp's PyTorch pickle checkpoint parser (versions prior to master-584-0a7ae07) allow a crafted or truncated .ckpt file to crash the loading application or leak process memory contents. The pickle opcode handlers in src/model.cpp advanced the buffer pointer without verifying remaining bytes before each read, meaning any application using this library to load untrusted .ckpt model files is exposed to denial-of-service and potential memory disclosure. No public exploit has been identified at time of analysis, though LibFuzzer triggered crashing inputs in under one second, indicating an extremely low barrier for generating working crash payloads.
Technical ContextAI
The vulnerable component is the PyTorch checkpoint (.ckpt) pickle parser in src/model.cpp of leejet/stable-diffusion.cpp (CPE: cpe:2.3:a:leejet:stable-diffusion.cpp:*:*:*:*:*:*:*:*), a pure C/C++ library for running Stable Diffusion, Flux, Wan, and related diffusion model inference. CWE-125 (Out-of-bounds Read) is the root cause: throughout the pickle parser, opcode handlers advanced the parser position using expressions such as 'buffer += N' without first verifying that 'buffer + N <= buffer_end'. A specially crafted or simply truncated .ckpt file can therefore drive reads past the end of the metadata buffer into adjacent memory. The fix (commit 0a7ae07) restructures checkpoint I/O by replacing the vulnerable ckpt_io.h parser entirely with separate torch_legacy_io and torch_zip_io modules that enforce proper bounds on every buffer advance, and renames the dispatching logic in model.cpp accordingly.
RemediationAI
Upstream fix available (commit 0a7ae07f948eff4611968a65a22bd7c7031ad74f); a formally tagged released version is not independently confirmed beyond the master-584-0a7ae07 identifier. Developers should update to or rebuild from commit 0a7ae07 or any subsequent commit, available at https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f. If an immediate update is not feasible, the vendor-recommended workaround is to restrict model loading exclusively to verified trusted sources and prefer the .safetensors format, which does not invoke the vulnerable pickle-based parser. Applications should implement an allowlist of permitted model file origins and refuse to process .ckpt files from arbitrary user-supplied URLs or unvetted community repositories. Note that switching to .safetensors eliminates the pickle attack surface entirely but may require model conversion for existing .ckpt weights, and not all community models have .safetensors equivalents available.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today