Out-of-Bounds Read Vulnerability in Stable Diffusion Library by LeeJet

CVE-2026-47748

What is CVE-2026-47748?

The stable-diffusion.cpp library, utilized for running various diffusion model inference, is susceptible to an out-of-bounds read error. This vulnerability arises from improper handling of the PyTorch checkpoint pickle opcode parsing, where the parser does not consistently validate that sufficient input exists before executing read operations. This oversight may lead to unsafe memory access during the processing of crafted or truncated .ckpt files. Attackers can exploit this flaw by enticing victims to load .ckpt files from untrusted sources, potentially leading to application crashes or further exploitation. It is recommended that all users of affected releases immediately update to version master-584-0a7ae07 and abstain from using untrusted checkpoint files. Safer alternatives, such as .safetensors format, should be prioritized.

References