{"id":865,"date":"2026-05-10T13:05:19","date_gmt":"2026-05-10T13:05:19","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=865"},"modified":"2026-05-10T13:05:19","modified_gmt":"2026-05-10T13:05:19","slug":"ollama-out-of-bounds-read-vulnerability-allows-remote-process-memory-leak","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=865","title":{"rendered":"Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak"},"content":{"rendered":"
\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed a critical security vulnerability in Ollama that, if successfully exploited, could allow a remote, unauthenticated attacker to leak its entire process memory.<\/p>\n

The out-of-bounds read flaw, which likely impacts over 300,000 servers globally, is tracked as CVE-2026-7482<\/strong> (CVSS score: 9.1). It has been codenamed<\/a>\u00a0Bleeding Llama<\/strong> by Cyera.<\/p>\n

Ollama<\/a> is a popular open-source framework that allows large language models (LLMs) to be run locally instead of on the cloud. On GitHub, the project has more than 171,000 stars and has been forked over 16,100 times.<\/p>\n

\u00abOllama before 0.17.1<\/a> contains a heap out-of-bounds read vulnerability in the GGUF model loader,\u00bb according to a description<\/a> of the flaw in CVE.org. \u00abThe \/api\/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file’s actual length; during quantization in fs\/ggml\/gguf.go and server\/quantization.go (WriteTo()), the server reads past the allocated heap buffer.\u00bb<\/p>\n

GGUF, short for GPT-Generated Unified Format, is a file format that’s used to store large language models so that they can be easily loaded and executed locally.<\/p>\n

The problem, at its core, stems from Ollama’s use of the unsafe package<\/a> when creating a model from a GGUF file, specifically in a function named \u00abWriteTo(),\u00bb thereby making it possible to execute operations that bypass the memory safety guarantees of the programming language.<\/p>\n

In a hypothetical attack scenario, a bad actor can send a specially crafted GGUF file to an exposed Ollama server with the tensor’s shape<\/a> set to a very large number to trigger the out-of-bounds heap read during model creation using the \/api\/create endpoint. Successful exploitation of the vulnerability could leak sensitive data from the Ollama process memory.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

This may include environment variables, API keys, system prompts, and concurrent users’ conversation data. This data can be exfiltrated by uploading the resulting model artifact through the \/api\/push endpoint to an attacker-controlled registry.<\/p>\n

The exploitation chain<\/a> unfolds over three steps –<\/p>\n

<\/p>\n