EUVD-2026-37198Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPublish malicious .ckpt on model hub
-
DeliveryVictim downloads checkpoint
-
ExploitApplication invokes ckpt loader
-
ExecutionMalformed GLOBAL opcode triggers -1 length
-
PersistHeap buffer overflow in pickle parser
-
ImpactArbitrary code execution as inference process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the target application to call stable-diffusion.cpp's legacy .ckpt loader path (is_ckpt_file → init_from_ckpt_file in src/model.cpp), (2) a victim or automated pipeline that loads a .ckpt file the attacker controls, typically downloaded from an untrusted model-sharing site, and (3) the .ckpt to contain a malformed GLOBAL opcode whose argument lacks the terminating newline, causing the parser's newline search to fail and feed -1 as a copy length. Exploitation is LIMITED by the CVSS UI:R requirement (a user or host app must explicitly load the file - opening a .safetensors model or any other supported format is not vulnerable), by AV:L (no network-reachable parser, the attacker cannot reach the code without filesystem-level delivery), and by the fact that applications that have already restricted inputs to .safetensors (a documented best practice in the ML ecosystem) are not exposed. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H justifies the 7.8 base score: local attack vector with required user interaction, but full CIA impact consistent with code execution from heap corruption. No EPSS score, KEV entry, or public POC was provided, so realistic risk is currently driven by the attack scenario rather than observed activity - meaningful but not emergency-tier for most defenders. The most important nuance is the AV:L choice: the bug is triggered by loading a file the victim chose to open, which is correctly modeled as local with UI:R, but in practice .ckpt files are routinely pulled from public model hubs, so the effective reachability resembles a malicious-document scenario more than a traditional local-only flaw. Confidence in technical impact is high (vendor advisory, fix commit, and PR diff all align); confidence in active exploitation is low because no KEV/POC signal is present. |
| Exploit ScenarioDerived | An attacker uploads a poisoned .ckpt checkpoint to a public model-sharing site (HuggingFace mirror, Civitai-style hub, Discord drop) advertised as a popular fine-tune; the file omits the expected newline after a GLOBAL opcode argument. When a developer, artist, or downstream application loads the model with stable-diffusion.cpp, the parser computes a -1 length, corrupts the heap during the copy, and the attacker uses the resulting write primitive to gain code execution as the user running the inference process. No public exploit identified at time of analysis, but the bug class (controlled-size heap OOB write in a pickle parser) is well within reach of an experienced exploit developer. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Heap buffer overflow in the leejet stable-diffusion.cpp pickle .ckpt parser allows arbitrary code execution when a user or host application loads a maliciously crafted checkpoint file. The flaw resides in the GLOBAL opcode handler within src/model.cpp, where missing newline validation lets a -1 length value drive a heap memory copy, corrupting the heap of the diffusion inference process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the attack surface (community model-sharing sites) makes weaponization plausible.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - upgrade to commit 0a7ae07f948eff4611968a65a22bd7c7031ad74f (referenced as master-584-0a7ae07) from PR https://github.com/leejet/stable-diffusion.cpp/pull/1443, which replaces the legacy ckpt loader with separate torch_legacy_io and torch_zip_io implementations. If you cannot rebuild immediately, the vendor-recommended workaround is to refuse .ckpt inputs entirely and accept only .safetensors models, which uses a non-executable tensor-only format and eliminates the pickle parser as an attack surface; the trade-off is that some community models are only published as .ckpt and will become unusable until reconverted. For environments that must continue accepting .ckpt, restrict loading to files originating from a vetted internal mirror and block direct downloads from public hubs at the proxy or filesystem layer, accepting the operational overhead of curating that mirror. Track the vendor advisory at https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-v37x-jwp7-mcvc for any follow-up release tagging.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
stable-diffusion.cpp is a pure C/C++ inference runtime for diffusion models (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image), and one of the legacy formats it accepts is the PyTorch pickle-based .ckpt container. The pickle virtual machine includes a GLOBAL opcode that historically reads two newline-terminated strings (module name and qualified name). According to the advisory, the parser searched for the delimiting newline without validating that one was actually found, then used the result as a length, allowing a wraparound to -1 (reinterpreted as a very large size_t) which feeds a downstream copy and writes past the destination heap buffer - a textbook CWE-787 out-of-bounds write, here driven by integer/size mis-handling in pickle stream parsing. The CPE cpe:2.3:a:leejet:stable-diffusion.cpp:*:*:* confirms the affected component is the upstream leejet project itself, and the remediation PR also refactors the loader into separate torch_zip_io and torch_legacy_io modules, indicating the parser was rewritten rather than patched in place.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Trigger requires loading an attacker-supplied file locally (AV:L, UI:R); no auth needed (PR:N); heap OOB write in-process yields full CIA impact (C:H/I:H/A:H), no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. In versions prior to master-584-0a7ae07, the pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the GLOBAL opcode handler. The issue was caused by missing validation when searching for newline-delimited fields. A crafted .ckpt file without the expected newline could cause the parser to use -1 as a copy length, resulting in immediate heap corruption. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. The issue has been resolved in version master-584-0a7ae07. If developers are unable to immediately update their applications they can work around this issue by following these instructions: do not load .ckpt checkpoint files from untrusted sources, and prefer trusted model sources and safer formats such as .safetensors where possible.
Executive ViewAI
leejet stable-diffusion.cpp contains a heap buffer overflow enabling arbitrary code execution when loading malicious checkpoint files from community model repositories, directly threatening organizations whose AI inference systems depend on publicly distributed models. Without available patches, organizations must immediately restrict model sources and isolate inference infrastructure to prevent code execution and lateral movement.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict model loading to internally-curated, cryptographically-verified checkpoint files; run inference processes in containerized/sandboxed environments with minimal privilege; implement network microsegmentation to isolate inference from sensitive systems; maintain immutable audit logs of model loads and process execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Exploit-DB