Heap Buffer Overflow in stable-diffusion.cpp Library Affects Untrusted Model Loading

CVE-2026-47750

What is CVE-2026-47750?

In the stable-diffusion.cpp library, a heap buffer overflow vulnerability exists in the .ckpt file parser due to insufficient validation of newline-delimited fields. This issue, present in earlier versions prior to master-584-0a7ae07, enables an attacker to corrupt the heap by providing a maliciously crafted .ckpt file. This situation requires the application to process checkpoint files from untrusted sources, which can lead to severe exploitation risks. Developers are urged to avoid loading such files and update to the latest version, or use trusted model sources and safer formats like .safetensors to mitigate potential threats.

References