CVE-2026-47748

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47748", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T22:16:39.504Z", "datePublished": "2026-06-16T17:11:15.143Z", "dateUpdated": "2026-06-16T18:42:49.132Z"}, "containers": {"cna": {"title": "stable-diffusion.cpp: Out-of-bounds reads in PyTorch checkpoint pickle opcode parsing", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-rx4w-x86j-vx57", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-rx4w-x86j-vx57"}, {"name": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f", "tags": ["x_refsource_MISC"], "url": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f"}], "affected": [{"vendor": "leejet", "product": "stable-diffusion.cpp", "versions": [{"version": "< master-584-0a7ae07", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-16T17:11:15.143Z"}, "descriptions": [{"lang": "en", "value": "stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to an out-of-bounds reads error through PyTorch checkpoint pickle opcode parsing. The pickle .ckpt parser in src/model.cpp did not consistently check that enough input remained before reading opcode arguments or advancing the parser buffer with a crafted or truncated .ckpt file. Throughout the pickle parser, opcode handlers advanced the parser position with expressions such as buffer += N without first checking that buffer + N <= buffer_end. A truncated file could therefore cause reads past the end of the metadata buffer. LibFuzzer found crashes in under one second using malformed checkpoint inputs. Any application using affected stable-diffusion.cpp releases to load untrusted .ckpt model files could be vulnerable. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. This issue has been fixed in version master-584-0a7ae07. If developers are unable to immediately update their applications, they can work around this issue by ensuring they do not load .ckpt checkpoint files from untrusted sources. They should prefer trusted model sources and safer formats such as .safetensors where possible."}], "source": {"advisory": "GHSA-rx4w-x86j-vx57", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-rx4w-x86j-vx57", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-16T18:41:44.220881Z", "id": "CVE-2026-47748", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T18:42:49.132Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47748", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-16T18:41:44.220881Z"}}}], "references": [{"url": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-rx4w-x86j-vx57", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T18:41:31.496Z"}}], "cna": {"title": "stable-diffusion.cpp: Out-of-bounds reads in PyTorch checkpoint pickle opcode parsing", "source": {"advisory": "GHSA-rx4w-x86j-vx57", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "leejet", "product": "stable-diffusion.cpp", "versions": [{"status": "affected", "version": "< master-584-0a7ae07"}]}], "references": [{"url": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-rx4w-x86j-vx57", "name": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-rx4w-x86j-vx57", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f", "name": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to an out-of-bounds reads error through PyTorch checkpoint pickle opcode parsing. The pickle .ckpt parser in src/model.cpp did not consistently check that enough input remained before reading opcode arguments or advancing the parser buffer with a crafted or truncated .ckpt file. Throughout the pickle parser, opcode handlers advanced the parser position with expressions such as buffer += N without first checking that buffer + N <= buffer_end. A truncated file could therefore cause reads past the end of the metadata buffer. LibFuzzer found crashes in under one second using malformed checkpoint inputs. Any application using affected stable-diffusion.cpp releases to load untrusted .ckpt model files could be vulnerable. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. This issue has been fixed in version master-584-0a7ae07. If developers are unable to immediately update their applications, they can work around this issue by ensuring they do not load .ckpt checkpoint files from untrusted sources. They should prefer trusted model sources and safer formats such as .safetensors where possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-16T17:11:15.143Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47748", "state": "PUBLISHED", "dateUpdated": "2026-06-16T18:42:49.132Z", "dateReserved": "2026-05-19T22:16:39.504Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-16T17:11:15.143Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "stable-diffusion.cpp", "vendor": "leejet", "versions": [{"status": "affected", "version": "< master-584-0a7ae07"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:leejet:stable-diffusion.cpp:*:*:*:*:*:c\\+\\+:*:*", "matchCriteriaId": "EF9A4C1B-8396-48E6-8E46-3A3767DA17FC", "versionEndExcluding": "master-584-0a7ae07", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to an out-of-bounds reads error through PyTorch checkpoint pickle opcode parsing. The pickle .ckpt parser in src/model.cpp did not consistently check that enough input remained before reading opcode arguments or advancing the parser buffer with a crafted or truncated .ckpt file. Throughout the pickle parser, opcode handlers advanced the parser position with expressions such as buffer += N without first checking that buffer + N <= buffer_end. A truncated file could therefore cause reads past the end of the metadata buffer. LibFuzzer found crashes in under one second using malformed checkpoint inputs. Any application using affected stable-diffusion.cpp releases to load untrusted .ckpt model files could be vulnerable. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. This issue has been fixed in version master-584-0a7ae07. If developers are unable to immediately update their applications, they can work around this issue by ensuring they do not load .ckpt checkpoint files from untrusted sources. They should prefer trusted model sources and safer formats such as .safetensors where possible."}, {"lang": "es", "value": "stable-diffusion.cpp es una biblioteca pura de C/C++ para ejecutar inferencia de modelos de difusi\u00f3n (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image y m\u00e1s). Las versiones anteriores a master-584-0a7ae07 son vulnerables a un error de lectura fuera de l\u00edmites a trav\u00e9s del an\u00e1lisis de c\u00f3digos de operaci\u00f3n pickle de puntos de control de PyTorch. El analizador pickle .ckpt en src/model.cpp no verificaba consistentemente que quedara suficiente entrada antes de leer los argumentos del c\u00f3digo de operaci\u00f3n o de avanzar el b\u00fafer del analizador con un archivo .ckpt manipulado o truncado. A lo largo del analizador pickle, los manejadores de c\u00f3digos de operaci\u00f3n avanzaban la posici\u00f3n del analizador con expresiones como buffer += N sin verificar primero que buffer + N <= buffer_end. Un archivo truncado podr\u00eda, por lo tanto, causar lecturas m\u00e1s all\u00e1 del final del b\u00fafer de metadatos. LibFuzzer encontr\u00f3 fallos en menos de un segundo utilizando entradas de puntos de control malformadas. Cualquier aplicaci\u00f3n que utilice versiones afectadas de stable-diffusion.cpp para cargar archivos de modelo .ckpt no confiables podr\u00eda ser vulnerable. El ataque requiere que la v\u00edctima o la aplicaci\u00f3n cargue un archivo .ckpt de una fuente no confiable, como un modelo descargado de un sitio de intercambio de modelos. Este problema ha sido solucionado en la versi\u00f3n master-584-0a7ae07. Si los desarrolladores no pueden actualizar inmediatamente sus aplicaciones, pueden solucionar este problema asegur\u00e1ndose de no cargar archivos de punto de control .ckpt de fuentes no confiables. Deben preferir fuentes de modelos confiables y formatos m\u00e1s seguros como .safetensors cuando sea posible."}], "id": "CVE-2026-47748", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47748", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-16T18:41:44.220881Z", "version": "2.0.3"}}]}, "published": "2026-06-16T19:16:55.720", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-rx4w-x86j-vx57"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-rx4w-x86j-vx57"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,master-584-0a7ae07)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "stable-diffusion.cpp", "source": "cna", "vendor": "leejet"}, "product": "stable-diffusion.cpp", "vendor": "leejet"}], "created": "2026-06-17T22:30:13.698461+00:00", "updated": "2026-06-23T21:05:11.227580+00:00", "vendors": ["leejet", "leejet$PRODUCT$stable-diffusion.cpp"]}