CVE-2026-7482
CWE-125Published: May 4, 2026· Updated: May 5, 2026
Official Description
Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file's actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer. The leaked memory contents may include environment variables, API keys, system prompts, and concurrent users' conversation data, and can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. The /api/create and /api/push endpoints have no authentication in the upstream distribution. Default deployments bind to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 configuration is widely used in practice (large public-internet exposure observed).
Risk Analysis
Ollama before 0.17.1 has a critical heap out-of-bounds read vulnerability in its GGUF model loader, allowing attackers to read past allocated memory. This can expose sensitive data like environment variables, API keys, and user conversation data. The CVSS score of 9.1 indicates a severe risk, and its presence in the KEV catalog confirms active exploitation.
This vulnerability is actively exploited in the wild and is remotely exploitable without authentication. Attackers can exfiltrate leaked memory contents by uploading a crafted model artifact.
Upgrade Ollama to version 0.17.1 or later. Ensure that the /api/create and /api/push endpoints are not exposed to untrusted networks, or implement authentication if possible.
Technical Analysis
CVE-2026-7482 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), availability disruption (denial of service), with a CVSS base score of 9.1.
CISA has added CVE-2026-7482 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
News & Research Mentioning CVE-2026-7482
Cybersecurity researchers have disclosed a critical security vulnerability in Ollama that, if successfully exploited, could allow a remote, unauthenticated attacker to leak its entire process memory. The out-of-bounds read flaw, which likely impacts over 300,000 servers globally, is tracked as CVE-2026-7482 (CVSS score: 9.1). It has been codenamed Bleeding Llama by Cyera. Ollama is a [xlite_meta score:50 src:The Hacker News xlite_fp:8605eb3ea653f26cd8c79993dadb9129c8e5722f1e7d9604ba7fc689e26e2312]
All References (3)
Quick Facts
Known Threat Actors
Related CVEs (CWE-125)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-7482 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1