CVE-2026-47750: stable-diffusion.cpp: Heap buffer overflow in GLOBAL opcode parsing for PyTorch checkpoint files

Synopsis

A heap buffer overflow vulnerability exists in the GLOBAL opcode handler of the pickle .ckpt parser in stable-diffusion.cpp, a C/C++ library for running diffusion model inference. The flaw is triggered locally when a user or application loads a crafted .ckpt checkpoint file from an untrusted source, such as a model downloaded from a model-sharing site; no network exposure or authentication is required beyond tricking the victim into opening the file. Successful exploitation corrupts heap memory and gives an attacker full read, write, and execution capability over the affected process. No fix version has been published upstream; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker does not need network access to the target system; they only need the victim to load a malicious .ckpt file, which can be delivered out-of-band (for example, via a model-sharing site download).

• AuthenticationNot required

  No account or credential on the target system is required; the vulnerability is triggered entirely through the act of loading a crafted file.

• Victim interactionRequired

  The victim or application must actively load a crafted .ckpt checkpoint file from an untrusted source, making social engineering (for example, pointing a user to a malicious model download) a prerequisite.

• Attack complexityDetail

  Attack complexity is low, meaning the overflow is reliably triggered by the malformed input without requiring specific memory layouts, race conditions, or other environmental conditions.

Blast Radius

• Heap memory is corrupted immediately upon parsing the malformed GLOBAL opcode, giving the attacker a primitive to overwrite adjacent heap allocations.
• An attacker can read process memory contents, exposing in-memory data such as loaded model weights, API keys, or intermediate inference results.
• An attacker can write arbitrary data into heap regions, modifying application state or persisted outputs produced by the inference process.
• The corrupted heap state causes the process to crash or, in a worst-case exploit chain, allows the attacker to redirect execution flow and run arbitrary code under the process's privileges.