stable-diffusion.cpp CVE-2026-47749

Exploitation requires the victim application to call the ckpt loader path on an attacker-supplied PyTorch .ckpt (pickle) checkpoint file - concretely, code reaching ModelLoader::init_from_ckpt_file / read_ckpt_file in src/model.cpp on a file whose pickle stream contains a crafted SHORT_BINUNICODE opcode with a length byte >= 0x80. The CVSS UI:R component is satisfied by the user choosing to load that file (drag-and-drop, CLI argument, GUI 'Load model' button, or downloading via an integrated model browser). No authentication, no network listener, and no special build configuration are required; the vulnerable opcode handler is in the default code path for .ckpt parsing. Limiting factors: AV:L means the attacker cannot reach the parser over the network directly - they must deliver the malicious .ckpt via a model-sharing site, email, or other side channel; deployments that only consume .safetensors files (or that never load externally sourced checkpoints) are not exploitable.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H scores 7.8 (High) and accurately reflects a local-file-driven memory corruption: exploitation requires the user to load an attacker-supplied .ckpt file (UI:R), but needs no prior authentication or privileges on the host. EPSS and CISA KEV data were not provided in the input, so probabilistic exploitation likelihood and active-exploitation status are unknown; given the niche audience (developers/researchers running C/C++ diffusion inference), widespread mass exploitation is unlikely, but targeted supply-chain attacks via poisoned models on Hugging Face / Civitai-style sharing sites are a credible scenario. The CVSS H/H/H impact is plausible because heap-overflow-to-RCE in native C/C++ code is well-precedented, but the description correctly hedges with 'could potentially be leveraged for code execution depending on heap layout' - so treat reliable RCE as uncertain and process crash / DoS as the confirmed outcome. No public exploit identified at time of analysis, lowering immediate urgency but not eliminating risk for anyone consuming third-party .ckpt files.

An attacker uploads a malicious 'fine-tuned' diffusion checkpoint to a public model-sharing site with attractive metadata; a developer or end user of a stable-diffusion.cpp-based tool downloads it and invokes the application's standard model-load flow on the .ckpt. While parsing the embedded pickle stream, the SHORT_BINUNICODE handler interprets a crafted 0x80+ length byte as a large negative signed value and calls memcpy with an enormous size, corrupting adjacent heap structures and either crashing the process or, with careful heap grooming, hijacking control flow to run the attacker's code with the user's privileges.