CVE-2026-7482: Ollama heap out-of-bounds read in GGUF model loader via /api/create

Summary

CVE-2026-7482 affects Ollama before 0.17.1. A heap out-of-bounds read in the GGUF model loader lets an attacker send a crafted GGUF file to the /api/create endpoint, where declared tensor offset and size exceed the file's real length. During quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer, and the leaked memory may include environment variables, API keys, system prompts and other users' conversation data. The attacker can exfiltrate it by pushing the resulting model artifact through /api/push to an attacker-controlled registry, and neither endpoint requires authentication in the upstream distribution.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• github.com/ollama/ollamaGoLLM dependency since 2023-07-08 · 2 tracked dependents

Topics

• Inference infrastructure

Related items

• InfoGem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization FrameworkSimilar attack · OpenAlex (peer-reviewed AI security)
• MediumCVE-2026-88982: Kubeflow Pipelines execution cache exposes cached outputs across namespacesSimilar attack · NVD/CVE Database
• MediumChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data ExfiltrationSimilar attack · Check Point Research
• MediumCVE-2026-121938: langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated…Similar attack · NVD/CVE Database
• MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer