CVE-2026-7482 Ollama Vulnerability

The CVE-2026-7482 vulnerability is a critical issue that affects Ollama versions before 0.17.1. It is a heap out-of-bounds read vulnerability in the GGUF model loader, which can be exploited by unauthenticated remote attackers. The vulnerability allows attackers to read past the allocated heap buffer, potentially exposing sensitive information such as environment variables, API keys, and system prompts.

The vulnerability is caused by the /api/create endpoint accepting an attacker-supplied GGUF file with a declared tensor offset and size that exceeds the file's actual length. During quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer, leading to the exposure of sensitive information. The leaked memory contents can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry.

The CVE-2026-7482 vulnerability has a severity rating of 9.1, which is considered critical. The impact of this vulnerability is significant, as it can lead to the exposure of sensitive information and potentially allow attackers to gain unauthorized access to the system. The fact that the /api/create and /api/push endpoints have no authentication in the upstream distribution makes it easier for attackers to exploit this vulnerability.

To mitigate this vulnerability, it is recommended to update Ollama to version 0.17.1 or later. Additionally, users should ensure that the /api/create and /api/push endpoints are properly authenticated and authorized to prevent unauthorized access. It is also important to monitor the system for any suspicious activity and to implement additional security measures, such as encryption and access controls, to protect sensitive information.