CVE-2026-7482 - Vulnerability Analysis

Overview

Ollama < 0.17.1 contains a heap out-of-bounds read caused by improper validation of tensor offset and size in GGUF model loader, letting remote attackers leak sensitive memory data via /api/create and /api/push endpoints, exploit requires no authentication.

Severity & Score

Impact

Remote attackers can leak sensitive memory contents including environment variables, API keys, and user data, leading to information disclosure.

Mitigation

Update to version 0.17.1 or later.

References

• https://github.com/ollama/ollama/commit/88d57d0483cca907e0b23a968c83627a20b21047
• https://github.com/ollama/ollama/pull/14406
• https://github.com/ollama/ollama/releases/tag/v0.17.1

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner