Executive brief
Ollama is an open-source framework for running large language models locally. A flaw in its GGUF file format decoder can cause integer overflow when processing specially crafted model files, potentially leading to memory corruption or denial of service when loading untrusted models.
Technical details
An integer overflow vulnerability exists in the readGGUFV1String function within the GGUF decoder component (fs/ggml/gguf.go). The vulnerability occurs due to improper bounds checking during parsing of GGUF file format structures. An attacker can craft a malicious GGUF model file with specially crafted size fields to trigger integer overflow during tensor element count calculation. The attack is remotely exploitable if Ollama is exposed to untrusted file sources (e.g., model download endpoints). The vulnerability has been patched in version 0.31.2-rc1 with commit 67b6a1c, which implements proper overflow detection by checking if multiplication of tensor dimensions would overflow before performing the calculation.
Affected products
- Ollama Ollama up to 0.31.1
Timeline
- 2026-09-07: disclosed
- 2026-07-06: patched: Fix available in version 0.31.2-rc1 (commit 67b6a1c2d45321e0cb3c04a18073f9818de7724b)