EUVD-2026-37138Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitation needs the user to open a malicious local .ckpt (AV:L, UI:R) with no auth (PR:N); heap-overflow primitive plausibly yields full C/I/A impact in-process.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to heap buffer overflow in SHORT_BINUNICODE parsing for PyTorch checkpoint files. The pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the SHORT_BINUNICODE opcode handler. The issue was caused by sign confusion on the opcode length field. A crafted .ckpt file could trigger memcpy with a very large length derived from a negative signed value, causing immediate heap corruption. Any application using affected stable-diffusion.cpp releases to load untrusted .ckpt model files could be vulnerable. A malicious checkpoint file could cause heap corruption through memcpy with an attacker-controlled length. This may lead to process crash and could potentially be leveraged for code execution depending on heap layout. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. The issue has been resolved in version master-584-0a7ae07. If developers are unable to immediately update their applications they can work around this issue by not loading .ckpt checkpoint files from untrusted sources, and referring to trusted model sources and safer formats such as .safetensors where possible.
AnalysisAI
Heap buffer overflow in stable-diffusion.cpp versions prior to master-584-0a7ae07 allows attackers to corrupt memory and potentially achieve code execution when a victim loads a malicious PyTorch .ckpt checkpoint file. The flaw resides in the SHORT_BINUNICODE opcode handler of the pickle parser in src/model.cpp, where a signed length field is mishandled and passed to memcpy. No public exploit identified at time of analysis, but the upstream fix is committed and the attack surface (untrusted model files from sharing sites) is realistic for AI/ML workloads.
Technical ContextAI
stable-diffusion.cpp is a pure C/C++ inference library for diffusion models (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image) developed by leejet, per CPE cpe:2.3:a:leejet:stable-diffusion.cpp. The library supports legacy PyTorch checkpoint (.ckpt) files, which are Python pickle streams containing opcodes that describe object reconstruction. The vulnerable code path is the SHORT_BINUNICODE opcode in src/model.cpp, which reads a 1-byte length prefix. Because the length was treated as a signed value, a byte value >= 0x80 sign-extends to a large negative integer; when implicitly converted to the size_t argument of memcpy, it becomes a very large unsigned length, copying far past the destination heap buffer. This is a classic CWE-787 out-of-bounds write driven by sign confusion in length parsing, and reflects the broader well-known danger of using Python pickle as a deserialization format - which is why the maintainer also restructured the loader into torch_legacy_io and torch_zip_io modules in the fix PR.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - update to master-584-0a7ae07 or later by pulling commit 0a7ae07 (https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f, merged via https://github.com/leejet/stable-diffusion.cpp/pull/1443) and rebuilding any application that vendors the library. Until the upgrade is deployed, the vendor-recommended workaround is to refuse to load .ckpt files from untrusted sources and to migrate users to the .safetensors format, which uses a safe, well-defined binary layout instead of pickle; the trade-off is operational, since some legacy community checkpoints are only distributed as .ckpt and will need to be re-exported. As a compensating control, restrict the directory from which .ckpt files can be read to a curated, trusted-author allowlist and reject files originating from user download paths, accepting the UX cost of blocking ad-hoc model imports.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today