Read the docs
TI-2026-06576 Aliases CVE-2026-7482GHSA-x8qc-fggm-mpqg

Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers

Priority MEDIUM 50CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file's actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer. The leaked memory contents may include environment variables, API keys, system prompts, and concurrent users' conversation data, and can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. The /api/create and /api/push endpoints have no authentication in the upstream distribution. Default deployments bind to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 configuration is widely used in practice (large public-internet exposure observed).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02241 82nd percentileScored 2026-11-07
Fix Fixed ollama (ollama): 0.17.1github.com/ollama/ollama (Go): 0.17.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ollamaollamabefore 0.17.10.17.1Patch availableCNA
—github.com/ollama/ollama (Go)before 0.17.10.17.1Patch availableGHSA-x8qc-fggm-mpqg
  • ollama Vendorollama Affected before 0.17.1 Fixed in 0.17.1 Patch available CNA
  • github.com/ollama/ollama (Go) Vendor— Affected before 0.17.1 Fixed in 0.17.1 Patch available GHSA-x8qc-fggm-mpqg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*before 0.17.1Vulnerableollama
  • cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:* Versions before 0.17.1 Vulnerable ·ollama

Remediation

  • Fix · CNA ollama (ollama) Fixed in 0.17.1
  • Fix · GHSA-x8qc-fggm-mpqg github.com/ollama/ollama (Go) Fixed in 0.17.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

Not affected: 5 products
  • Migration Toolkit for Applications 8
  • Red Hat Ansible Automation Platform 2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat Trusted Profile Analyzer
  • Red Hat build of Debezium 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7482
  2. 2026-10-03 Alias added: GHSA-x8qc-fggm-mpqg

References

Patch 2

Advisory 1

Other 2

  • TI-2024-24572 Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex… CVSS 3.1HIGH 8.8
  • TI-2025-14153 Ollama Multi-Modal Model Image Processing NULL Pointer Dereference CVSS 4.0HIGH 8.7
  • TI-2024-26641 An issue was discovered in Ollama before 0.1.46. CVSS 3.1HIGH 8.2
  • TI-2025-41098 An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via… CVSS 3.1HIGH 7.5
  • TI-2025-41097 An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder CVSS 3.1HIGH 7.5
  • TI-2025-01720 Improper Validation of Array Index in ollama/ollama CVSS 3.0HIGH 7.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences