Is CVE-2025-15514 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15514 being exploited in the wild.

How severe is CVE-2025-15514?

High severity, with a CVSS score of 7.5, published 12 January 2026.

Which products and versions are affected?

Ollama 0.11.5-rc0 through 0.13.5.

Is there a fix for CVE-2025-15514?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-15514 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-15514?

Check whether you run Ollama or Red Hat OpenShift AI (RHOAI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15514: Ollama null pointer dereference in multi-modal image processing

CVE-2025-15514 · Severity: high · CVSS 7.5 · Published 2026-01-12

Ollama, a tool used to run large language models locally, is vulnerable to a flaw that allows an attacker to crash the service. By sending a specially crafted image through the chat interface, an attacker can cause the application to stop responding to all users. This results in a total service outage until the software is manually restarted.

Technologies: Ollama, Red Hat OpenShift AI (RHOAI). Vendors: Ollama, Red Hat.

Quick answers

Is CVE-2025-15514 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15514 being exploited in the wild.
How severe is CVE-2025-15514?: High severity, with a CVSS score of 7.5, published 12 January 2026.
Which products and versions are affected?: Ollama 0.11.5-rc0 through 0.13.5.
Is there a fix for CVE-2025-15514?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-15514 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-15514?: Check whether you run Ollama or Red Hat OpenShift AI (RHOAI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A null pointer dereference vulnerability exists in Ollama's multi-modal image processing via the /api/chat endpoint. The application fails to validate that base64-encoded image data represents valid media before passing it to the mtmd_helper_bitmap_init_from_buf function. This function returns NULL for malformed input, which is subsequently dereferenced without a check, causing a segmentation fault. A remote, unauthenticated attacker can exploit this by sending malformed base64 data to crash the runner process. The vulnerability affects versions 0.11.5-rc0 through 0.13.5.

Affected products

Ollama Ollama 0.11.5-rc0 through 0.13.5
Red Hat Red Hat OpenShift AI (RHOAI)

Timeline

2026-01-12: disclosed
2026-01-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.