Ollama Memory Leak CVE-2026-7482 Reproduced: High Risk

🚨 Ollama memory leak vulnerability reproduced: CVE-2026-7482 is high severity

Security researchers have reproduced the Ollama memory leak vulnerability (CVE-2026-7482), a heap out-of-bounds read vulnerability:

• Affected versions: all versions of Ollama before 0.17.1
• Vulnerability type: heap out-of-bounds read (CWE-125)
• Attack path: /api/create → GGUF loading → quantization → memory leak → exfiltration via /api/push
• Leaked data: environment variables, API keys, system prompts, user conversations
• No authentication: the /api/create and /api/push endpoints require no auth

🎯 The vulnerability at its core

The GGUF model loader vulnerability

The vulnerability is in the GGUF model loader:

• /api/create endpoint accepts attacker-supplied GGUF files
• tensor offset and size exceed the actual file length
• During quantization, reads go beyond the allocated heap buffer
• Location: fs/ggml/gguf.go and server/quantization.go (WriteTo())

What gets leaked

Leaked memory contents may include:

Leaked data	Risk
Environment variables	May contain sensitive configuration
API keys	High: exposes API keys
System prompts	Exposes internal configuration
Other users' conversation data	High: privacy breach

How data gets exfiltrated

The leaked memory contents can be exfiltrated through the /api/push endpoint:

• Model upload: upload the resulting model artifact
• Attacker registry: push it to a registry the attacker controls
• No authentication: the endpoint is unauthenticated in the upstream distribution

⚠️ Risk level

CVSS 4.0 score

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A/V:D/RE:L/U:Red

Dimension	Score	Description
Attack vector	Network (AV:N)	Exploitable over the network
Attack complexity	Low (AC:L)	Easy to pull off
Privileges required	None (PR:N)	No authentication needed
User interaction	None (UI:N)	No user interaction needed
Confidentiality impact	High (VC:H)	High confidentiality impact
Availability impact	High (VA:H)	High availability impact

📊 Affected deployments

Default configuration

Ollama binds by default127.0.0.1, but the OLLAMA_HOST=0.0.0.0 configuration is widely used:

• Default binding: 127.0.0.1 (local only)
• Public exposure: OLLAMA_HOST=0.0.0.0 (widely used)
• Mass exposure: large numbers of internet-facing instances observed

High-risk scenarios

Scenario	Risk
Internet-exposed Ollama	Critical: directly attackable
Multi-user shared Ollama	High: can leak other users' conversations
Environments with sensitive API keys	High: API keys can leak
Local deployments	in: requires local access

🔧 Mitigations

Option 1: Upgrade to 0.17.1+ (recommended)

# 升级 Ollama
# macOS
brew upgrade ollama

# Linux
curl -fsSL https://ollama.com/install.sh | sh

What's fixed: the patch fixes the GGUF loader's out-of-bounds read.

Option 2: Limit network exposure

# 不要使用 0.0.0.0 绑定
# 保持默认 127.0.0.1
OLLAMA_HOST=127.0.0.1

Option 3: Firewall restrictions

# 限制 /api/create 和 /api/push 端点访问
# 只允许可信来源

Option 4: Monitor for suspicious GGUF files

• Check GGUF files: verify tensor offsets and sizes are sane
• Monitor /api/create: log the origin of uploaded GGUF files
• Monitor /api/push: log the target registry of uploads

🚀 Reproduction status

Reproduced: security researchers have successfully reproduced this vulnerability:

• Conditions: Ollama < 0.17.1
• Attack path: upload a malicious GGUF → trigger quantization → memory leak
• Leak verified: successfully leaked environment variables and conversation data
• Exfiltration verified: successfully exfiltrated data via /api/push

📅 Patch info

Item	Link
Fixed version	v0.17.1
Patch commit	88d57d0483
PR	#14406

📝 Summary

The Ollama CVE-2026-7482 memory leak vulnerability has been reproduced:

• Affects all versions of Ollama before 0.17.1
• Heap out-of-bounds read, CWE-125
• Leaks: environment variables, API keys, system prompts, user conversations
• Exfiltration path: /api/push uploads to an attacker-controlled registry
• Unauthenticated endpoints: /api/create and /api/push
• Public exposure risk: OLLAMA_HOST=0.0.0.0 is widely used
• Mitigation: upgrade to 0.17.1+ or limit network exposure

A high-severity vulnerability, already reproduced — upgrade or lock down exposure now.

NVD:https://nvd.nist.gov/vuln/detail/CVE-2026-7482

Fixed version:https://github.com/ollama/ollama/releases/tag/v0.17.1