stable-diffusion.cpp CVE-2026-47748

Exploitation requires the victim application to load a .ckpt format PyTorch checkpoint file originating from an untrusted source - the vulnerability is not triggered by .safetensors, GGUF, or other non-pickle model formats. The CVSS attack vector is local (AV:L), meaning the malicious file must be present on the system and explicitly loaded by the application or user (UI:R); remote network delivery alone is insufficient without this final load step. No privileges are required of the attacker (PR:N per CVSS). Exploitation is therefore limited to deployments where the application accepts .ckpt model files, particularly pipelines that auto-download community models from sharing platforms. Applications that exclusively load .safetensors files or enforce a trusted-source allowlist are not affected, as the vulnerable parser is only invoked for .ckpt inputs.

The CVSS 3.1 score of 5.5 (Medium) reflects a local attack vector requiring user interaction - an attacker cannot exploit this without the victim first loading a crafted .ckpt file, making automated mass exploitation unlikely. The vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H scores availability impact as High (crash) with no confidentiality or integrity impact. However, the source data tags this vulnerability as 'Information Disclosure,' which conflicts with the C:N CVSS score - out-of-bounds reads in C/C++ parsers routinely expose adjacent heap or stack memory, and defenders should treat potential memory leakage as a realistic secondary impact pending vendor clarification. No CISA KEV listing exists and no public exploit has been identified at time of analysis. Critically, LibFuzzer triggered crashes in under one second with malformed inputs, indicating that any threat actor with basic fuzzing capability could rapidly generate working crash payloads without sophisticated exploit development. The practical risk is highest for applications that automatically download and load community-sourced .ckpt model files, where the UI:R user-interaction requirement effectively becomes a design feature of normal operation rather than a true exploitation barrier.

An attacker publishes a maliciously crafted or deliberately truncated .ckpt model file on a popular model-sharing platform such as Hugging Face or CivitAI. A developer or end-user downloads and loads the file into an application built on an unpatched version of stable-diffusion.cpp, triggering the out-of-bounds read in the pickle opcode parser, which causes an application crash or, depending on runtime memory layout, leaks adjacent heap contents. Because LibFuzzer demonstrated crashing inputs can be generated in under one second, no sophisticated exploit development is required beyond constructing a malformed .ckpt file.