Executive brief
Ollama is an open-source platform used to run and manage large language models (LLMs). A security flaw in how it processes model files allows an attacker to read sensitive information from the server's memory, including API keys, environment variables, and private conversation data from other users. Because the affected components often lack authentication by default, an attacker could remotely steal this data and send it to their own servers.
Technical details
A heap out-of-bounds read exists in Ollama's GGUF model loader within fs/ggml/gguf.go and server/quantization.go. The vulnerability is triggered via the /api/create endpoint when a user supplies a GGUF file with tensor offset and size values that exceed the actual file length. During the quantization process (WriteTo()), the server reads past the allocated heap buffer. An attacker can exfiltrate the leaked memory—which may contain API keys, environment variables, and concurrent user data—by using the /api/push endpoint to send the resulting model to an attacker-controlled registry. These endpoints are unauthenticated in default upstream distributions.
Affected products
- Ollama Ollama before 0.17.1
Timeline
- 2026-02-24: patched: Release v0.17.1 published
- 2026-02-25: other: Fix merged into main branch
- 2026-05-04: advisory: CVE-2026-7482 published