Ollama Memory Leak (CVE-2026-7482) Reproduced: Advisory

[Reproduced] Security Advisory: Ollama Memory Leak Vulnerability (CVE-2026-7482)

Security researchers have recently disclosed a serious memory leak vulnerability (CVE-2026-7482) in Ollama, the open-source LLM inference platform. The flaw lets attackers read sensitive data from server memory under certain configurations, including environment variables, API keys, system prompts, and other users' conversation data.

The vulnerability lives in Ollama's GGUF model loader. With a carefully crafted malicious GGUF file, an attacker can trigger a heap out-of-bounds read and leak data from server memory.

Vulnerability overview

What makes this one especially dangerous is that it can leak not just the current session's data, but also the private data of other concurrently served users. Since Ollama is widely used to run local LLM inference, many companies and developers have API endpoints exposed on internal networks or the public internet — which makes this a serious potential threat.

CVE details

CVE ID: CVE-2026-7482
CWE classification: CWE-125 – Out-of-bounds Read
Vulnerability type: memory leak / heap buffer over-read
Disclosed by: Echo security team

Vulnerability details

How it works

The vulnerability is in Ollama's GGUF model loader, specifically in these files:

fs/ggml/gguf.go
server/quantization.go in the WriteTo() function

The attack flow is as follows:

The attacker uploads a maliciously crafted GGUF file via the /api/create endpoint
The tensor offsets and sizes declared in the GGUF file exceed the actual file length
During quantization, the server reads beyond the allocated memory buffer
The leaked memory data may contain sensitive information
The attacker uploads a model containing the leaked data through the /api/push endpoint to a registry they control

Affected versions

Affected versions: Ollama < 0.17.1

Safe versions: Ollama 0.17.1 and above

Attack conditions

The server is configured with OLLAMA_HOST=0.0.0.0 (exposed to the public internet)
The attacker can reach the /api/create and /api/push endpoints
An Ollama service is running on the server

Potential impact

Leak sensitive configuration from environment variables
Steal API keys and access tokens
Obtain system prompts and model configurations
Read other users' conversation data
Enable possible supply chain attacks

Remediation recommendations

Immediate actions

Upgrade Ollama: upgrade to Ollama 0.17.1 or later immediately
Restrict access: set OLLAMA_HOST to 127.0.0.1 and avoid exposing it to the public internet
Add authentication: configure an API authentication mechanism
Network isolation: restrict access to the Ollama port through a firewall

Long-term protection

Keep Ollama updated to the latest stable version
Apply the principle of least privilege
Enable access logging and security monitoring
Run regular security audits

Protective measures

Advice for enterprises

Assess the risk: check whether internal systems run affected Ollama versions
Update systems: verify in a test environment first, then upgrade immediately
Harden security: implement network isolation and access controls
Monitoring and alerts: set up security event monitoring with a fast response process

Advice for developers

Never expose Ollama API endpoints in production
Use a reverse proxy to add an extra layer of security
Review and update dependencies regularly
Follow secure coding best practices

References

Final thoughts

This disclosure is yet another reminder that security in open-source LLM platforms matters. Companies and developers should act now: upgrade to a safe version and put proper protections in place.

Security is never a small matter — prevention beats cure!