The stable-diffusion.cpp library, used for diffusion model inference, contains an out-of-bounds read vulnerability (CWE-125) in its PyTorch checkpoint (.ckpt) pickle opcode parser. The parser in src/model.cpp fails to verify that sufficient input remains before reading opcode arguments or advancing the buffer pointer. Specifically, opcode handlers increment the parser buffer position without confirming that the new position does not exceed the buffer end. This flaw allows a crafted or truncated .ckpt file to cause reads beyond the metadata buffer boundary, leading to crashes. The vulnerability affects all versions prior to the fix in commit master-584-0a7ae07. Exploitation requires loading a malicious .ckpt file from an untrusted source. The issue was discovered via fuzzing and no known exploits are reported in the wild.

Successful exploitation results in out-of-bounds reads that can cause application crashes (denial of service). There is no indication of confidentiality or integrity impact. The vulnerability requires local or limited access to load a malicious .ckpt file, which typically involves user interaction to load untrusted model files. This limits the attack vector to scenarios where untrusted checkpoint files are processed.

A fix is available in stable-diffusion.cpp at commit master-584-0a7ae07. Users and developers should update to this version to remediate the vulnerability. If immediate updating is not possible, avoid loading .ckpt checkpoint files from untrusted sources. Prefer trusted model repositories and safer checkpoint formats such as .safetensors to reduce risk.