The stable-diffusion.cpp library's pickle .ckpt parser in src/model.cpp contains a heap buffer overflow vulnerability in the GLOBAL opcode handler caused by missing validation of newline-delimited fields. Specifically, a crafted .ckpt file lacking the expected newline causes the parser to use -1 as a copy length, leading to immediate heap corruption. Exploitation requires the victim to load a malicious .ckpt checkpoint file from an untrusted source. The vulnerability is resolved in version master-584-0a7ae07. Developers unable to upgrade immediately are advised to avoid untrusted .ckpt files and prefer trusted sources or safer file formats such as .safetensors.

Successful exploitation can lead to heap corruption, resulting in potential arbitrary code execution, data corruption, or application crashes. The vulnerability affects confidentiality, integrity, and availability of the affected application. However, exploitation requires user interaction to load a malicious .ckpt file from an untrusted source.

A fix is available in stable-diffusion.cpp version master-584-0a7ae07. Users and developers should upgrade to this version to remediate the vulnerability. If immediate upgrade is not possible, do not load .ckpt checkpoint files from untrusted sources. Prefer trusted model sources and safer formats such as .safetensors to avoid exposure to this vulnerability.