Bug 2464938 (CVE-2026-7482)

Summary: CVE-2026-7482 github.com/ollama/ollama: ollama: Ollama: Information disclosure via heap out-of-bounds read in GGUF model loader
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: dschmidt, erezende, jlanda, kshier, rjohnson, simaishi, smcdonal, stcannon, teagle, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Ollama. A remote attacker can exploit a heap out-of-bounds read vulnerability in the GGUF model loader by providing a specially crafted GGUF (GGML Unified Format) file to the /api/create endpoint. This allows the attacker to read beyond the allocated memory buffer, potentially disclosing sensitive information such as environment variables, API keys, system prompts, and user conversation data. The leaked data can then be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. Both /api/create and /api/push endpoints lack authentication in the upstream distribution, increasing the risk of exploitation.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2476396, 2476395    
Bug Blocks:    

Description OSIDB Bzimport 2026-05-04 13:01:23 UTC 
Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file's actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer. The leaked memory contents may include environment variables, API keys, system prompts, and concurrent users' conversation data, and can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. The /api/create and /api/push endpoints have no authentication in the upstream distribution. Default deployments bind to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 configuration is widely used in practice (large public-internet exposure observed).