CVE-2026-86289 Details
Description
A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.31.2-rc1 is capable of addressing this issue. The patch is named 67b6a1c2d45321e0cb3c04a18073f9818de7724b. It is recommended to upgrade the affected component.
An integer overflow vulnerability has been identified in Ollama versions through 0.31.1, specifically within the GGUF Decoder component. The issue arises in the 'readGGUFV1String' function located in 'fs/ggml/gguf.go'. The vulnerability can be exploited remotely, leading to a denial-of-service condition by causing the application to crash. The problem occurs when the decoder processes a malicious GGUF v1 model file that contains a zero-length string, which underflows the string's length and causes a panic. This vulnerability has been publicly disclosed and could be actively exploited.
Users are advised to upgrade to Ollama version 0.31.2-rc1, which addresses this vulnerability by adding proper checks to prevent the string length underflow. The patch can be found in the release notes for version 0.31.2-rc1.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ollama/ollama/ | [email protected] | ProductVendor |
| https://github.com/ollama/ollama/commit/67b6a1c2d45321e0cb3c04a18073f9818de7724b | [email protected] | Source CodeVendor |
| https://github.com/ollama/ollama/issues/17033 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/ollama/ollama/pull/17062 | [email protected] | Issue TrackingVendor |
| https://github.com/ollama/ollama/releases/tag/v0.31.2-rc1 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-86289 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/906136 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399448 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/399448/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-189 | Numeric Errors | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ollama | <= 0.31.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | [email protected] |