CVE-2026-7482Critical· 9.1▾ AbyssalPoC availableOllama contains a heap out-of-bounds read vulnerability in the GGUF model loader
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.1 · likelihood 0.4 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.9%
1.9% → 2.2%
3 GitHub repos
Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file's actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer. The leaked memory contents may include environment variables, API keys, system prompts, and concurrent users' conversation data, and can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. The /api/create and /api/push endpoints have no authentication in the upstream distribution. Default deployments bind to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 configuration is widely used in practice (large public-internet exposure observed).
github.com/ollama/ollama < 0.17.1Upgrade to a patched release:
github.com/ollama/ollama 0.17.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-7020Medium· 5.6Ollama is Vulnerable to Path Traversal
CVE-2024-28224High· 8.8Ollama DNS rebinding vulnerability
CVE-2024-8063High· 7.5Ollama Divide by Zero Vulnerability
CVE-2025-63389Critical· 9.8A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3
CVE-2026-102697High· 7.8Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax
CVE-2026-65315High· 7.5Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser