Ollama Out-of-Bounds Read Leaks Process Memory
Ollama's GGUF loader has a nasty out-of-bounds read that dumps the whole process memory to remote attackers. Unauth anyone hits exposed servers and grabs API keys, prompts, chats.
CVE-2026-7482, dubbed Bleeding Llama, scores CVSS 9.1. Attackers upload crafted GGUF files to /api/create with oversized tensor data, triggering reads past heap buffers in fs/ggml/gguf[.]go during quantization.
Hits Ollama before 0.17.1 on roughly 300,000 internet-facing servers, often via OLLAMA_HOST=0.0.0.0 binding. Exposes env vars and concurrent user data.
Attackers exfiltrate leaks by pushing tainted models via /api/push to their registries.
Source: The Hacker News