CVE-2026-7482 Details
Description
Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file's actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer. The leaked memory contents may include environment variables, API keys, system prompts, and concurrent users' conversation data, and can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. The /api/create and /api/push endpoints have no authentication in the upstream distribution. Default deployments bind to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 configuration is widely used in practice (large public-internet exposure observed).
A heap out-of-bounds read vulnerability has been identified in Ollama versions prior to 0.17.1, specifically within the GGUF model loader. The vulnerability arises in the /api/create endpoint, which accepts user-supplied GGUF files. Attackers can exploit this by crafting files that include tensor offsets and sizes exceeding the actual file length. During the quantization process, the server inadvertently reads beyond the allocated heap buffer. This out-of-bounds read can leak sensitive memory contents, such as environment variables, API keys, system prompts, and conversation data from other users. The exfiltrated data can be uploaded as part of a model artifact through the /api/push endpoint to an attacker-controlled registry. Notably, the /api/create and /api/push endpoints do not require authentication in the default Ollama distribution. While default deployments are bound to 127.0.0.1, the widely used OLLAMA_HOST=0.0.0.0 configuration exposes these endpoints to the public internet.
Users are advised to update Ollama to version 0.17.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ollama/ollama/commit/88d57d0483cca907e0b23a968c83627a20b21047 | Echo | Patch |
| https://github.com/ollama/ollama/pull/14406 | Echo | Issue TrackingPatch |
| https://github.com/ollama/ollama/releases/tag/v0.17.1 | Echo | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | Echo |
Affected Products
| Product | Versions |
|---|---|
| ollama ollama | < 0.17.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | Echo |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | New CVE Received | Echo |