EUVD-2026-37198Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Trigger requires loading an attacker-supplied file locally (AV:L, UI:R); no auth needed (PR:N); heap OOB write in-process yields full CIA impact (C:H/I:H/A:H), no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. In versions prior to master-584-0a7ae07, the pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the GLOBAL opcode handler. The issue was caused by missing validation when searching for newline-delimited fields. A crafted .ckpt file without the expected newline could cause the parser to use -1 as a copy length, resulting in immediate heap corruption. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. The issue has been resolved in version master-584-0a7ae07. If developers are unable to immediately update their applications they can work around this issue by following these instructions: do not load .ckpt checkpoint files from untrusted sources, and prefer trusted model sources and safer formats such as .safetensors where possible.
AnalysisAI
Heap buffer overflow in the leejet stable-diffusion.cpp pickle .ckpt parser allows arbitrary code execution when a user or host application loads a maliciously crafted checkpoint file. The flaw resides in the GLOBAL opcode handler within src/model.cpp, where missing newline validation lets a -1 length value drive a heap memory copy, corrupting the heap of the diffusion inference process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the attack surface (community model-sharing sites) makes weaponization plausible.
Technical ContextAI
stable-diffusion.cpp is a pure C/C++ inference runtime for diffusion models (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image), and one of the legacy formats it accepts is the PyTorch pickle-based .ckpt container. The pickle virtual machine includes a GLOBAL opcode that historically reads two newline-terminated strings (module name and qualified name). According to the advisory, the parser searched for the delimiting newline without validating that one was actually found, then used the result as a length, allowing a wraparound to -1 (reinterpreted as a very large size_t) which feeds a downstream copy and writes past the destination heap buffer - a textbook CWE-787 out-of-bounds write, here driven by integer/size mis-handling in pickle stream parsing. The CPE cpe:2.3:a:leejet:stable-diffusion.cpp:*:*:* confirms the affected component is the upstream leejet project itself, and the remediation PR also refactors the loader into separate torch_zip_io and torch_legacy_io modules, indicating the parser was rewritten rather than patched in place.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - upgrade to commit 0a7ae07f948eff4611968a65a22bd7c7031ad74f (referenced as master-584-0a7ae07) from PR https://github.com/leejet/stable-diffusion.cpp/pull/1443, which replaces the legacy ckpt loader with separate torch_legacy_io and torch_zip_io implementations. If you cannot rebuild immediately, the vendor-recommended workaround is to refuse .ckpt inputs entirely and accept only .safetensors models, which uses a non-executable tensor-only format and eliminates the pickle parser as an attack surface; the trade-off is that some community models are only published as .ckpt and will become unusable until reconverted. For environments that must continue accepting .ckpt, restrict loading to files originating from a vetted internal mirror and block direct downloads from public hubs at the proxy or filesystem layer, accepting the operational overhead of curating that mirror. Track the vendor advisory at https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v37x-jwp7-mcvc for any follow-up release tagging.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today