CVE-2026-7482 Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers
Unauthenticated attackers can leak server memory via malformed GGUF files, exposing secrets and user data if the server is exposed to the network.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-7482?
CVE-2026-7482 is a high-severity vulnerability in ollama, published on 4 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file's actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer. The leaked memory contents may include environment variables, API keys, system prompts, and concurrent users' conversation data, and can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. The /api/create and /api/push endpoints have no authentication in the upstream distribution. Default deployments bind to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 configuration is widely used in practice (large public-internet exposure observed).
Weakness: CWE-125
Which versions are affected by CVE-2026-7482?
3 open source packages ship an affected version, including github.com/ollama/ollama. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ollama/ollama Go | All versions | 0.17.1 |
github.com/ollama/ollama Go | All versions | 0.17.1 |
github.com/ollama/ollama Go | All versions | 0.17.1 |
Linux distribution packages (1)
ollama openSUSE:Tumbleweed | All versions | 0.33.1-1.1 |
Products include Ollama Ollama.
How do I fix CVE-2026-7482?
Upgrade github.com/ollama/ollama to 0.17.1 or later.
Is CVE-2026-7482 being exploited?
There is no known exploitation of CVE-2026-7482 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in ollama
- CVE-2025-63389 Ollama Platform has missing authentication enabling attackers to perform model management operations
- CVE-2024-45436 Ollama can extract members of a ZIP archive outside of the parent directory
- CVE-2024-37032 Ollama does not validate the format of the digest (sha256 with 64 hex digits)
- CVE-2025-15514 Ollama Multi-Modal Model Image Processing NULL Pointer Dereference
- CVE-2024-39720 Ollama Out-of-bounds Read
Sources
Also known as GHSA-x8qc-fggm-mpqg, GO-2026-5748, MINI-478v-jgqg-cx74, openSUSE-SU-2026:11688-1.