Ollama: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader
Ollama
More for Ollama RSS feed for Ollama
- Severity
- Critical, CVSS 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Record
- CVE-2026-7482
- Affects
- Ollama
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 4, 2026
- Source last modified
- June 17, 2026
Description
Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file's actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer. The leaked memory contents may include environment variables, API keys, system prompts, and concurrent users' conversation data, and can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. The /api/create and /api/push endpoints have no authentication in the upstream distribution. Default deployments bind to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 configuration is widely used in practice (large public-internet exposure observed).
Description quoted from the NVD record.
Who is affected
Ollama is a program that runs AI language models on your own server. This flaw affects versions before 0.17.1, in the part that builds new models from uploaded model files. An attacker could upload a crafted model file that makes Ollama read memory it should not. That memory may hold secret keys, system settings, instructions given to the AI and other users' conversations, which the attacker could send to a server they control. These features need no login. By default Ollama only accepts connections from the same computer, but a widely used setting opens it to other computers, including over the internet. This flaw is rated Critical.
What to do
- Find out whether anyone in your organization runs Ollama, and who installed it or looks after it.
- If you or a staff member runs Ollama, update it to version
0.17.1or later. The person who installed it should do this as soon as possible. - If an IT provider or vendor runs Ollama for your organization, send them this advisory and ask when the update to
0.17.1will be done. - Until the update is done, the person who runs Ollama should check whether it is reachable from other computers, since the default setup only accepts connections from the same computer.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.