CVE-2026-47749: stable-diffusion.cpp: Heap buffer overflow in SHORT_BINUNICODE parsing for PyTorch checkpoint files

Synopsis

A heap buffer overflow vulnerability affects the stable-diffusion.cpp library's PyTorch checkpoint (.ckpt) file parser. The flaw is reached locally when a user or application loads a crafted .ckpt file, with no authentication required but requiring the victim to open the malicious file. Successful exploitation causes heap corruption, crashing the process and potentially enabling arbitrary code execution. No upstream fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker does not need network access; they deliver the malicious .ckpt file through other means, and exploitation happens locally on the host that loads it.

• AuthenticationNot required

  No account or credentials are needed to exploit the flaw; the vulnerability is triggered purely by parsing a crafted file.

• Victim interactionRequired

  A user or automated process must actively load the malicious .ckpt model file, for example by downloading it from a model-sharing site and passing it to the application.

• Attack complexityDetail

  Exploit reliability is high under typical conditions, but achieving code execution (beyond a crash) depends on heap layout at the time of the overflow, which varies across environments.

Blast Radius

• The affected process suffers immediate heap corruption, causing a crash that disrupts any inference workload relying on that service.
• Depending on heap layout at runtime, an attacker may gain the ability to execute arbitrary code within the process running stable-diffusion.cpp.
• A successful code-execution scenario gives the attacker full read access to data in that process, including model weights, prompts, and any secrets held in memory.
• The attacker can also modify or destroy in-memory state, corrupting outputs or persisted artifacts written by the process.