CVE-2026-47748
- Source
- https://cve.org/CVERecord?id=CVE-2026-47748
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47748.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-47748
- Aliases
-
- GHSA-rx4w-x86j-vx57
- Published
- 2026-06-16T17:11:15.143Z
- Modified
- 2026-07-15T15:30:20.484757Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- stable-diffusion.cpp: Out-of-bounds reads in PyTorch checkpoint pickle opcode parsing
- Details
-
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to an out-of-bounds reads error through PyTorch checkpoint pickle opcode parsing. The pickle .ckpt parser in src/model.cpp did not consistently check that enough input remained before reading opcode arguments or advancing the parser buffer with a crafted or truncated .ckpt file. Throughout the pickle parser, opcode handlers advanced the parser position with expressions such as buffer += N without first checking that buffer + N <= buffer_end. A truncated file could therefore cause reads past the end of the metadata buffer. LibFuzzer found crashes in under one second using malformed checkpoint inputs. Any application using affected stable-diffusion.cpp releases to load untrusted .ckpt model files could be vulnerable. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. This issue has been fixed in version master-584-0a7ae07. If developers are unable to immediately update their applications, they can work around this issue by ensuring they do not load .ckpt checkpoint files from untrusted sources. They should prefer trusted model sources and safer formats such as .safetensors where possible.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47748.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-125" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47748.json
- https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-rx4w-x86j-vx57
- https://nvd.nist.gov/vuln/detail/CVE-2026-47748
- https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f
Affected packages
Git / github.com/leejet/stable-diffusion.cpp
Affected ranges
- Type
- GIT
- Repo
- https://github.com/leejet/stable-diffusion.cpp
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
{ "cpe": "cpe:2.3:a:leejet:stable-diffusion.cpp:*:*:*:*:*:c\\+\\+:*:*", "source": [ "AFFECTED_FIELD", "CPE_RANGE", "REFERENCES" ], "extracted_events": [ { "introduced": "0" }, { "fixed": "master-584-0a7ae07" } ] }
Affected versions
Other
master-004dfbe
master-0362cc4
master-036ba9e
master-0739361
master-09cab2a
master-0d7f04b
master-0d8b39f
master-0d9b801
master-0d9d665
master-0e64238
master-0e86d90
master-0ebe6fe
master-10c6501
master-10feacf
master-134883a
master-141a4b4
master-14206fd
master-14da17a
master-176a00b
master-1896b28
master-193fb62
master-195d170
master-19d876e
master-19fbfd8
master-1b5a868
master-1bdc767
master-1be2491
master-1c168d9
master-1ce1c1a
master-1ce9470
master-1d2af5c
master-2027b16
master-21ce9fe
master-225162f
master-23de7fc
master-2535ad5
master-298-1e5f207
master-299-567f9f1
master-2b1bc06
master-2b6ec97
master-2c5f3fc
master-2c9b1e2
master-2d4a2f7
master-2e79a82
master-2eac844
master-2eb3845
master-300-171b222
master-301-fd693ac
master-302-1e0d282
master-305-f3140ea
master-306-2abe945
master-309-35843c7
master-30b3ac8
master-314-02af48a
master-315-e70d020
master-316-5b261b9
master-317-aa68b87
master-318-beb99a2
master-319-9727c6b
master-31e77e1
master-320-1c32fa0
master-321-5436f6b
master-322-c64994d
master-323-2e9242e
master-324-a7d6d29
master-325-e370258
master-326-40a6a87
master-330-db6f479
master-331-90ef5f8
master-332-0723ee5
master-333-64a7698
master-334-d05e46c
master-335-48e0a28
master-336-917f7bf
master-338-faabc5a
master-339-062490a
master-340-9e28be6
master-341-8a45d0f
master-343-dd75fc0
master-346-c42826b
master-347-6103d86
master-348-8f6c5c2
master-349-fb748bb
master-349439f
master-350-c2d8ffc
master-351-0fa3e1a
master-352-d2d3944
master-353-ee89afc
master-353ee93
master-354-8ecdf05
master-355-694f0d9
master-356-4ffcbca
master-357-59ebdf0
master-358-347710f
master-359-6448430
master-360-aa44e06
master-361-e8eb379
master-362-742a733
master-363-199e675
master-364-6d6dc1b
master-365-d5b05f7
master-366-f532972
master-367-b88cc32
master-368-28ffb6c
master-369-a14e2b3
master-36ec16a
master-370-aa2b8e0
master-371-5498cc0
master-372-b542894
master-373-e9bc3b6
master-375-45c4677
master-3753223
master-376-490c51d
master-377-2034588
master-378-52b67c5
master-379-0249509
master-380-673dbdd
master-382-bc80225
master-383-20eb674
master-385-34a6fd4
master-386-0743a1b
master-387-e4c50f1
master-390-edf2cb3
master-391-5865b5e
master-392-bcc9c0d
master-393-118683d
master-394-3f3610b
master-395-985aedd
master-396-689e44c
master-397-bfbb929
master-398-2f0bd31
master-3a25179
master-3ac48ea
master-3bae667
master-3bf1665
master-3d854f7
master-3fb275a
master-3ffffa6
master-401-0392273
master-402-96c3e64
master-403-583a02e
master-405-e72aea7
master-406-d939f6e
master-407-1ac5a61
master-408-8823dc4
master-409-a3a88fc
master-410-11ab095
master-411-2aecdd5
master-412-6888fcb
master-413-15d0f82
master-414-8f05f5b
master-415-d96b415
master-416-614f873
master-417-43a70e8
master-418-200cb6f
master-419-e687913
master-420-a23262d
master-421-9fa7f41
master-422-ebe9d26
master-423-c3ad6a1
master-424-c2e18c8
master-425-bda7fab
master-426-97cf2ef
master-427-78e15bd
master-430-7c88c47
master-431-23fce0b
master-432-60abda5
master-433-88ec9d3
master-434-50ff966
master-435-ca5b196
master-437-30a9113
master-438-298b110
master-440-3e81246
master-442-3e6c428
master-443-3d5fdd7
master-444-a0adcfb
master-445-860a78e
master-446-df4efe2
master-447-ccb6b0a
master-448-37c9860
master-449-cc10771
master-450-a2d83dd
master-451-d0d836a
master-452-51bd9c8
master-453-4ff2c8c
master-454-6eefd2d
master-455-a119a4d
master-456-2cef4ba
master-457-b90b1ee
master-4584286
master-45d0ebb
master-462-c5602a6
master-463-e7e83ed
master-466-27b5f17
master-467-0e52afc
master-468-885e62e
master-470-48d3161
master-471-7010bb4
master-472-fbce16e
master-473-9565c7f
master-474-61659ef
master-475-2efd199
master-477-639091f
master-478-c6206fb
master-479-e50e1f2
master-47dd704
master-480-b87fe13
master-482-3295711
master-483-5e4579c
master-484-fa61ea7
master-485-4ccce02
master-486-7837232
master-487-43e829f
master-489-3959109
master-48956ff
master-48bcce4
master-490-e63daba
master-492-f957fa3
master-493-65891d7
master-494-9f56833
master-495-f0f641a
master-496-5e26437
master-497-aa0b899
master-498-c7ccafb
master-499-d60fb27
master-49d6570
master-4a5e7b5
master-4a6e36e
master-4a81904
master-4c6475f
master-4fe83d5
master-500-3296545
master-502-45ce78a
master-503-adea272
master-504-636d3cb
master-505-c5eb1e4
master-506-c9cd497
master-507-b314d80
master-509-4cdfff5
master-511-e64baa3
master-512-60889bc
master-513-39d5470
master-514-5792c66
master-515-810ef0c
master-516-d41f5ff
master-517-ba35dd7
master-519-7c880f8
master-51b53d4
master-520-d950627
master-521-9b424db
master-522-3d33caa
master-523-c8fb3d2
master-525-d6dd6d7
master-527-adfef62
master-528-f6968bc
master-529-630ee03
master-52a97b3
master-533-862a658
master-534-997bb11
master-535-84cbd88
master-536-5265a5e
master-536f3af
master-537-545fac4
master-539-ed88e21
master-540-f16a110
master-541-8f2967c
master-542-02dd5e5
master-543-8d87887
master-544-83e8f6f
master-545-1d6cb0f
master-546-4d52320
master-547-4fe7a35
master-548-bf02167
master-549-6dfe945
master-550-09b12d5
master-551-99c1de3
master-552-87ecb95
master-553-687a81f
master-554-9369ab7
master-555-7397dda
master-556-359eb8b
master-557-5bf438d
master-558-8afbeb6
master-559-dd75372
master-55c2e05
master-560-e8323ca
master-561-be9f51b
master-562-118489e
master-563-7ade90e
master-564-fd35047
master-567-ee5bf95
master-568-9ac7b67
master-569-c41c5de
master-570-5c243db
master-572-1b4e9be
master-575-2bcff67
master-576-6a9cb31
master-577-f3f69e2
master-578-4d626d2
master-579-3c99f70
master-580-7d33d4b
master-581-e77e4c4
master-582-7023fc4
master-583-6614334
master-5869987
master-587a37b
master-59080d3
master-5ae4795
master-5b8996f
master-5c561ea
master-5c614e4
master-6167e29
master-646e776
master-64d231f
master-65fa646
master-675208d
master-697d000
master-69c7378
master-69efe3c
master-6bbaf16
master-6c88ad3
master-6d16f68
master-6d84a30
master-6ea8122
master-730585d
master-73c2176
master-760cfaa
master-7620b92
master-76c7262
master-78ad76f
master-79c9fe9
master-7be65fa
master-7cb41b1
master-7dac89a
master-7eb30d0
master-7fb8a51
master-8124588
master-8142803
master-81556f3
master-8376dfb
master-838beb9
master-83ef4e4
master-85e9a12
master-87cdbd5
master-8847114
master-8909523
master-8a87b27
master-8c7719f
master-8d0819c
master-8f4ab9a
master-8f6b4a3
master-8f94efa
master-90e9178
master-9251756
master-9578fdc
master-968fbf0
master-97ad3e7
master-9842a3f
master-9a9f3da
master-9b1d90b
master-9c51d87
master-9e7befa
master-a28d04d
master-a469688
master-a65c410
master-a772dca
master-ab835f7
master-abb115c
master-abb36d6
master-ac54e00
master-ac5a215
master-ac8f5a0
master-ae1d5dc
master-afea457
master-afec505
master-b017918
master-b1cc40c
master-b1fc16b
master-b247581
master-b54bec3
master-b5f4932
master-b636886
master-b6899e8
master-b7870a0
master-b85b236
master-b9e4718
master-bd1eaef
master-c542a77
master-c587a43
master-c6071fa
master-c607fc3
master-c648001
master-c837c5d
master-c8f85a4
master-c9b5735
master-ca33304
master-cb1d975
master-cc92a6a
master-ce1bcc7
master-d00c948
master-d164236
master-d42fd59
master-d46ed5e
master-d765b95
master-d7af2c2
master-d7c7a34
master-d7f430c
master-d9b5942
master-dafc32d
master-dc0882c
master-dc46993
master-dcf91f9
master-ddc4a18
master-e1384de
master-e410aeb
master-e5a7aec
master-e71ddce
master-ec82d52
master-ecf5db9
master-ed37498
master-eea77cb
master-eed97a5
master-ef5c3f7
master-f23b803
master-f27f2b2
master-f2e4d97
master-f469b83
master-f4c937c
master-f50a7f6
master-f5997a1
master-f6b9aa1
master-f7f05fb
master-f8fe4e7
master-f99bcd1
master-fbd18e1
master-fbd42b6
master-fce6afc
master-ff4fdbb
Database specific
vanir_signatures_modified
"2026-07-15T15:30:20Z"
vanir_signatures
[
{
"id": "CVE-2026-47748-069f2732",
"signature_version": "v1",
"digest": {
"function_hash": "228001765830995913462489836826325648483",
"length": 180.0
},
"signature_type": "Function",
"target": {
"function": "find_char",
"file": "src/model_io/ckpt_io.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-2ca4138f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"237757203836965882021922365094362426010",
"197586819065820803022898881132653365734",
"133447650367936732668520802912363829744"
]
},
"signature_type": "Line",
"target": {
"file": "src/model_io/tensor_storage.h"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-38c78e09",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"42625952947728818317440082751145874433",
"67532102538927747525221678078185925386",
"26872512771225625337462152665638362544",
"141002614708271543739925736710659279959",
"77404357282904442645270355583684549192",
"302550418366182082093679366354647315631",
"60522225915984607474033193679830369396",
"327892589527493245484604120312687115702",
"323643213294539723313405651013346828571",
"138217158266693351610785733716437425228",
"203218313828708333586259277655281505572",
"15945319201526166590254258931389199027",
"137972022980463167933485676255970415205",
"326837847791138160123678287039199851772",
"20465025536169167689462007325998757616",
"319897474071683701560866417726660903210",
"325214592888342763159662251257375257196",
"58590557791120843591896598802398425030",
"28410992620600935914717008756401532573",
"20985713815190875306379306579762994742",
"128183180741896977415861268121044915422",
"200348194663521502231042527084737840999",
"43139797324274430631930314331211912705",
"162896642750714977094458763106047171854",
"173718903589850361308088138541585254602",
"37468398246647495891498603819619789196",
"308693261226897777934010912160329963573",
"134661090853722224549521687419344778212",
"248076672658194197696772290579356212703",
"330103819268964848863037912401225645703",
"186953193888140525943858732032985534891",
"74246881390524096979976681333883811992",
"106957372955943332858401507753933382838",
"187184058485696366398437124660059467956",
"178734045518812830777644322162301353861",
"324693543674776810633285044724721431628",
"155708465403677065587776905811968901446",
"132087131405824432944049022606583101812",
"90453793076784140943951312993893042790",
"101172167598038942439109321554956234166",
"329935132350341867310832499803039500918",
"22383014696402144974548802216000581893",
"105206651166843385985969082946589230621",
"188713432116365725977214590349314946514",
"236151642557011100056413866726890359405",
"331907416747110212646255676912758868291",
"128990689583762332774291353439392553185",
"227825898101243252348518458532171065625",
"180856890580343521193469349155247175156"
]
},
"signature_type": "Line",
"target": {
"file": "src/model.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-491102d1",
"signature_version": "v1",
"digest": {
"function_hash": "122354106344844325235054926985956811669",
"length": 309.0
},
"signature_type": "Function",
"target": {
"function": "read_int",
"file": "src/model_io/ckpt_io.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-578cb055",
"signature_version": "v1",
"digest": {
"function_hash": "71250369827246707102162498129063558683",
"length": 807.0
},
"signature_type": "Function",
"target": {
"function": "ModelLoader::init_from_file",
"file": "src/model.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-6c7a87e1",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"124276238116558141190241339017096725867",
"273665032823497640302720697389104321814",
"313327843533028970985754985989960292284",
"144297084820055695436890168252348180853"
]
},
"signature_type": "Line",
"target": {
"file": "src/model.h"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-96003aff",
"signature_version": "v1",
"digest": {
"function_hash": "282172098589846221198415821176503670220",
"length": 177.0
},
"signature_type": "Function",
"target": {
"function": "read_short",
"file": "src/model_io/ckpt_io.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-9966e357",
"signature_version": "v1",
"digest": {
"function_hash": "86347000680220176388394807099512672283",
"length": 495.0
},
"signature_type": "Function",
"target": {
"function": "read_u64",
"file": "src/model_io/safetensors_io.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-a1f90206",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174258662389011345058368439457005621507",
"40594772363217994070169506049329940466",
"150004788866058398063888508472505002808",
"59884527387644537113736842533630002383",
"127477026687268772370265575122675699795",
"97624124780378552269231458477775758365"
]
},
"signature_type": "Line",
"target": {
"file": "src/model_io/ckpt_io.h"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-a6d10d82",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114447677149058183888906427712298497819",
"77664512627503059049237304258386173555",
"286183645219794266647939853216916125286",
"51425098233445228869242354410004367133",
"48453347620594325921688466282676454643",
"297633073353965775889003722309282935226",
"15549047485068540001750948965876519917",
"95019936925946252182294157629842175423",
"36319874547941221462603814064681740225",
"99893025077873920130896498996908212311",
"47019671342429707826564460759323554191",
"281484916488458321438094226396181661875",
"273444941207662021402214486914471575325",
"40131108885509593244353558424856794510",
"62042015789367816213552516316300488905",
"36851468508534026829004434898555929969",
"118355529124272728116669235136347887038",
"297217385208193891544739075081924327910",
"162145251181574395802585264700284118730",
"76801604317074663206267938771559159780",
"123830209138272090247879900502472063774",
"154554579618781823868966155707004466092",
"30805022276652042512727047512887569001",
"39974067122707319998687072480414592576",
"252363664580124751528602748892460343841",
"155941175319167220992427784326146436779"
]
},
"signature_type": "Line",
"target": {
"file": "src/model_io/safetensors_io.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-b11b8e45",
"signature_version": "v1",
"digest": {
"function_hash": "149829370758341515500870040816365812702",
"length": 1978.0
},
"signature_type": "Function",
"target": {
"function": "parse_data_pkl",
"file": "src/model_io/ckpt_io.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-c14a27ff",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"239004289534659548485551272882231478762",
"80242958653530429446300040307038393639",
"199744471528589343604377291529062163861",
"300477200659463852336839658419194375517",
"19397766061201672198123297649505346355",
"294264875028764394408745252745839663738",
"187009962088274832226059556389688785143",
"225130832127790144999399713868952741098",
"339202610944227568332207291074276485123",
"314549937778405971304864568176251911788",
"337293934145597348958707099133801575757",
"81840048580265117372628450981952256609",
"310093487136164693177138029869793522538",
"187901409060169415250642183603498296534",
"304351187613803363464607021510574935182",
"105877300817236530946243484817923087262",
"201743890985905856472086667131492202845",
"155284349177213150099705485300838757949",
"7740556357772856694275211820332867236",
"288466307519051437292971475703729198194",
"96694304019258955231785049130006722836",
"131744771710964831235885079369483647513",
"108665026766329716673634977298376223358",
"136716939607054202824105605323069147931",
"187901409060169415250642183603498296534"
]
},
"signature_type": "Line",
"target": {
"file": "src/denoiser.hpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-c334e41d",
"signature_version": "v1",
"digest": {
"function_hash": "189260086133566964215143638601587542657",
"length": 567.0
},
"signature_type": "Function",
"target": {
"function": "ModelLoader::init_from_ckpt_file",
"file": "src/model.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-cdd345eb",
"signature_version": "v1",
"digest": {
"function_hash": "293834170905246243688272709923323401853",
"length": 598.0
},
"signature_type": "Function",
"target": {
"function": "convert",
"file": "src/model.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-dd108796",
"signature_version": "v1",
"digest": {
"function_hash": "144804922639526201075070914331346607144",
"length": 872.0
},
"signature_type": "Function",
"target": {
"function": "read_ckpt_file",
"file": "src/model_io/ckpt_io.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-e513828f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"30928193056597667540781280127613588266",
"322093638753582096785173656182750433902",
"28993343886333646849624166058166620859",
"200996139273186320783528949795151902618",
"275432540288311813752848153806964926150",
"279767662849922684247844151590405010625",
"7914162533976916492013810949412894855",
"260147894487772817944539384226981216595",
"294267274896475505523936678176276592226",
"219166636411220950532230565536833990015",
"117161595884253076724777062463254253304",
"4767780676007091913224723952296167582",
"155038973658636506421841877586878519873",
"283990904134719652927679439508570399038",
"229759829895135967172983416475093316156",
"84068413875016559790823296428708150407",
"125225023123905161650851492435730914901",
"38821052960267382185252479044651053342",
"71547071125448700667046116507336775733",
"235720014204309172426582605791982724168",
"50238303670973479650100827812739752573",
"137504633347491077821052970362856939712",
"236603796137210386104216186545791028388",
"329669881056014441746496477457255640126",
"284204054226543465020423726003623331010",
"119030220509566994221602187402630496276",
"124461481099112751116654687986252189704",
"83567423825101830667408480097641797275",
"114020212306298542643700885042795288126",
"76294723669689383682864940845714035396",
"147814992935508328413750057977070301908",
"222810118118442885009671382063747901745",
"44899589948376480770923429523197231811",
"220782949366866279787156866140630697477",
"98539401014531316230788456194380785703",
"67995289171870193157274039442875364074",
"92571267308060965360612802263809269495",
"90538063168247043999599212561558305959",
"339223709730745722962357283413022508780",
"44129020557262195444475682955132714830",
"273512747552526711123792217581198359326",
"200405983008129662624458473067828388927",
"60895490366291077032884614930605382641",
"93788607332272949284269652561123067571",
"62753790282738401904614895844723237242",
"228828473858560061597931035149452574263",
"298061181470912498387851500771037418263",
"255197622587072728858203184129120596001",
"222354241456146834582598204048204184363",
"5278159512294084934177409709885416136",
"225100035659839178103420753234085943379",
"39248318333466619060783093808505238813",
"143500332278715407208566390237178410440",
"321582594469493977737296820769390755714",
"241217421399612969453462336509414468559",
"319113583609042216063296680895959262143",
"56125921434048304339888173413108940531",
"45396896457898122182848442243160207751",
"56801833168999860684791181283977343267",
"303206089732182705232337374963907345755",
"327228973799784503756178064862003990589",
"87879352583368422295544083505043455773",
"89743682103586535821326744077522037990",
"250437683840117725439284108637660102313",
"259628013173553909034857100584855943966",
"172102645116778085389554935734401858547",
"193945555105656936453847297800470789796",
"323245726785595540969301721676905939070",
"176041848162441646659659023654266678749",
"51853364731994930043089533228317125450",
"334337261795775031617266531296625890369",
"92866185896523913753030385081156805176",
"95431303916101222113025745123289139030",
"303942020363371169791108143740940223247",
"113718310748462680829292320354357937606",
"114174191209979435050238925839499787777",
"106210493611478247472496393364309526800",
"208721315884096544766723289208979756834",
"302776997708563496349620790902062903804",
"158577901348324689754360002443282491265",
"285489161116990015020629747075990081770",
"317257247606132281734449337209201923166",
"326237061597000928810195310300500400777",
"250723233493595857189399580970746146093",
"62065094781657893659922650606971810568",
"168645557651438726454383801615135401050",
"242282075585375071902620561163324325362",
"31064060640904551023405479764444134295",
"243878993264242500987000137626965209407",
"173339198082920791336332109297044435222",
"164715690746924083906932820736324323306",
"24073679722535653141011236501442869470",
"216402888786013939061583257238412930688",
"54940784959720787017768103975238528260",
"160306980991805536652564224449177083316",
"242224236847114107602490548766502077801",
"318225106806696015771147712929222135987",
"299997419108937624433974161652164698794",
"172301482845041952912036001530840944159",
"307432953681914983657919534466409370583",
"74844253208219536375967416451948750247",
"66880478885471850886644137720346867838",
"49259759628709267738995759591855467458",
"11087616134042568263538273140797612308",
"315916334277394585932934512590995272288",
"171929169224617013304617971222857754696",
"230763075280176577164666540182424236093",
"262776785781112680461785546774075140184",
"185761475600719487133500517623549958702",
"51469924641357116350760572238317998812",
"206391183991632542008667005629426080423",
"317299657746041441650624568340216412263",
"9380349059932793679259752944831204104",
"76516736669748070422508923001606064072",
"180695172875155843662437446861906995516",
"259839555155506602518327070771410862046",
"70008756602902493414733300063536011969",
"103100140979164889830116239935557263237",
"250184876836653228472892882012669051303",
"189609634926436284322997657791199784564",
"72114699293254118401387391529547096255",
"143121139624474137479755660008422789602",
"136688298418638334438096889176049352302",
"167740696452586075089212783894239846259",
"248295465149958617709190778074305570393",
"50006816662818022071284192177106037819",
"266975622341661924602176963553756342038",
"211736861346035603607628331665880827179",
"137760982089658597884480274295231054738",
"48366604688918667463180562117153391194",
"63154250914009337636932393714516977473",
"275441293087186758137529757229734088941",
"277181944423155535414422913531020022982",
"74983634492203617257049549367789168295",
"13163766934700385429089769548020034012",
"282222504763010711228728963000436840031",
"91616146436615530925538334992380291457",
"104897562571112093648296376733771060366",
"4902447770414393583784569794449584508",
"116174134295305093322368078645289083608",
"112783490842406143175859161451860077826",
"77121588920349946809142142199107669189",
"262735683330632248171617819956717510922",
"297084456451072919127252642553386213615",
"294369068458155984127386377092405847113",
"149589816878302529196081545782868430100",
"26139979176722891459133439404041155372",
"333277563423255366169961093141828457777",
"240903421375865011206299161312692576825",
"138308218684761338587532531892834496678",
"151289828092964938287619657129067876895",
"217248212753089906540647708695409378976",
"292787933247790504656404222742192134387",
"162626518166349443517135012282815866681",
"290298369292630984589131731701887988814",
"112628415934802626336904877938266970780",
"221144022015265542527741400284863241049",
"266721201433187080999913084979366321428",
"138507306751871345070049311070631551507",
"325982639936448062521116403894533166749",
"111674522716519404722271569994602924805",
"8810516589694179673362835992821480340",
"131655508257070321447647417152449675345",
"66620253989993240603478290599482829165",
"188283010062707907747580479649696939469",
"97745250925130701894738828005037596962",
"223423247733642304781580154138133919431",
"153501186325371069026867980429809792778",
"48111872343634326372686466884500447299",
"331422738917292660534856408970379718843",
"182201221548075974600252556729921210489",
"28311233669340218512528210891403503997",
"284237734358126978036277868178844495235",
"81894750941311400954223076232494031882",
"153312692967403490062712660184124863934",
"196415601597998225246685353008835532122",
"71600430443181212853634064966478368727",
"38167051224704982499828473239602514370",
"330281914299641633058773418158984365099",
"288831638266253750557992158625824924030",
"173306914466352819566516374727383718813",
"168073856040885249483524578964405093388",
"213136141859259972383207209194395188496",
"109570256478566307231840301475588433124",
"258110614741095762045066349075733254050",
"119256325399785433236132497939972320420",
"13905887293488226615137916870036180496",
"166610938844347500841796604334708797251",
"295392806340721406144789802606422255966",
"9028840054126048318031877492002062837",
"266211718957203556288455821810256996550",
"168304472932502658995928872449411753419",
"55324750043941876677202196176979508045",
"289525123005420012073961980965692781711",
"153412043906718429817575663847234181828",
"46826149998194687103120816900419042520",
"153689358277420053468779128495415479488",
"33811564534356714512932978338734446769",
"5455536494888906971883440611925647759",
"214774189658448220229384923066308911267",
"79792776067433063106119403713864889204",
"307645422482223545961008083508236619460",
"136849195616443223599261167880371081215",
"337305682315167954661611633077682768624",
"50202004999078732506260527229906919454",
"141952281995184558961880891023256369819",
"248911131007879313606707643776564433750",
"57214049173683866989983916944288906238",
"92845519283004051011494144437884031860",
"126761615354355069682498085103967884715",
"126244413495195102820846149510201733405",
"49067577071686724059062519103122694713",
"119349916555975111015175924757868500898",
"218439895422894971264994836154567053772",
"239290550834998451771523759364098572302",
"32122820229908081273019779120310807176",
"125801141926790628802758860418119146279",
"2881142162955021246497748889113319792",
"330077586762855843383294162539350785213",
"322127251950480684943321732249631299772",
"156869477211809415842416578267306797488",
"225597789320068444583268042597952315852",
"337325164830572204141389021645720960808",
"308173275321816323819958815274190610707",
"160754108721239462482406803745273754563",
"75379806652795264210612313849964098619",
"294490816255394053495189530829711875762",
"274437138146048204125487217219241807361",
"273044645211350846033584871890401335473",
"163365333947463192760216260292028193514",
"75407180318704451699303769443305508093",
"201813785989310512801353197422550506197",
"63023319149774050960125992398873200987",
"178729662649919707064631884080216003849",
"198518162421555017890189792402813315166",
"10411300158427960015564307383122595007",
"10175277421591135214896299128268116693",
"260606779332814604757537785924054384391",
"122340195816189461033102588996756798780",
"282988320220318256031205267609541725657",
"73762442580120299682759592012838729730",
"263250291338680516443006557755776976896",
"222887938056838036278992038218611081677",
"283086717533456513884003863621421158827",
"71007805844807837521337810500979929356",
"39121566821325685523784216520497453333",
"243788047733268740511256979199621308281",
"81837222456195695248395476756880761698",
"71232454775765730595913329955898051046",
"15868784905032612952095695465893955276",
"137197534355578325698257623930772633340",
"225490420666979678670755636040804323703",
"838387548697439608241963065344344200",
"22065278419023581101112711949523301309",
"183540439997803250623710990156086901903",
"27502209793022594781348903292346764913",
"207081149554474344031959423894706888084",
"52419030786533827519927556560059137566",
"124985815800767276228960211051758332951",
"250336817384647716566955200585257218416",
"209156113944655225476546103716369374669",
"338291020617740268154365806644170559034",
"51449426936907299201471605740080688975",
"330496747525971003329442495436135947457",
"186595260402515593977382598931022188489",
"132551833961791182804096671081317698831",
"319763524757104180280222403069125135095",
"250929191188208667066639599679702106298",
"169029667072219779893246810286675257329"
]
},
"signature_type": "Line",
"target": {
"file": "src/model_io/ckpt_io.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-f6ec9fa7",
"signature_version": "v1",
"digest": {
"function_hash": "182733607619527597926872348262053989217",
"length": 723.0
},
"signature_type": "Function",
"target": {
"function": "is_safetensors_file",
"file": "src/model_io/safetensors_io.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
},
{
"id": "CVE-2026-47748-f953139f",
"signature_version": "v1",
"digest": {
"function_hash": "211912674620336809038475977715106288095",
"length": 2869.0
},
"signature_type": "Function",
"target": {
"function": "read_safetensors_file",
"file": "src/model_io/safetensors_io.cpp"
},
"source": "https://github.com/leejet/stable-diffusion.cpp/commit/0a7ae07f948eff4611968a65a22bd7c7031ad74f",
"deprecated": false
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47748.json"