CVE-2026-7482: Heap OOB Read in Ollama

The core of the vulnerability lies in the GGUF model loader within Ollama. An attacker can craft a malicious GGUF file where the declared tensor offset and size exceed the file's actual length. When the server attempts to quantize this file, it reads past the allocated heap buffer in fs/ggml/gguf.go and server/quantization.go. This out-of-bounds read allows the attacker to potentially access arbitrary memory regions. The leaked memory contents can include highly sensitive data, such as API keys used to access external services, environment variables containing configuration secrets, system prompts that define the model's behavior, and the conversation history of other users interacting with the Ollama instance. The attacker can then exfiltrate this data by uploading the resulting model artifact through the /api/push endpoint.

1. Reserviert2026-04-30
2. Veröffentlicht2026-05-04
3. EPSS aktualisiert2026-05-12

The primary mitigation for CVE-2026-7482 is to immediately upgrade Ollama to version 0.17.1 or later. This version contains the necessary fix to prevent the out-of-bounds read. If upgrading is not immediately feasible, consider implementing stricter input validation on the /api/create endpoint to prevent the acceptance of potentially malicious GGUF files. While not a complete solution, this can reduce the attack surface. Network segmentation can also limit the potential for lateral movement if the Ollama instance is compromised. Monitor Ollama logs for unusual activity, particularly related to file uploads and model quantization processes. Consider implementing a Web Application Firewall (WAF) with rules to detect and block suspicious GGUF file uploads.