CVE-2026-47747: stable-diffusion.cpp has a Heap-based Buffer Overflow

Synopsis

Heap-based buffer overflow in stable-diffusion.cpp affects the pickle .ckpt file parser in src/model.cpp. The vulnerability is triggered locally when a user opens a crafted .ckpt checkpoint file, requiring no authentication but needing user interaction to load the file. Successful exploitation causes heap corruption that gives an attacker full read access, write access, and the ability to crash or take control of the process. No fix version has been published to a package registry yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as a release is tagged.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing service exposure is required.

• AuthenticationNot required

  No account or credential is required to supply a malicious .ckpt file to the vulnerable parser.

• Victim interactionRequired

  A user must open or load a crafted .ckpt checkpoint file, making social engineering (e.g. distributing a malicious model file) the delivery mechanism.

• Attack complexityDetail

  The exploit is reliable and condition-free once the malicious file is loaded; no race conditions or special memory layout assumptions are needed.

Blast Radius

• Reads arbitrary heap memory, exposing in-process data such as model weights, intermediate tensors, and any secrets held in process memory.
• Overwrites heap structures with attacker-controlled bytes, allowing modification of application state or persistent data written after the corruption.
• Crashes the host process immediately due to heap corruption, taking down any service or pipeline stage running the library.
• In environments where the process runs with elevated permissions, heap control may be escalated to arbitrary code execution within that security context.