CVE-2025-15514

[CVE catalog]

Severity

High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jan 1, 2025, 12:00:00 AM UTC

Updated

Aug 17, 2026, 7:16:23 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.77% · Oct 27, 2026

A flaw was found in Ollama's multi-modal model image processing functionality. A remote attacker can exploit this by sending specially crafted base64-encoded image data to the `/api/chat` endpoint. This malformed input can lead to a null pointer dereference, causing a segmentation fault and crashing the runner process. This results in a denial of service (DoS) condition, making the model unavailable until the service is restarted. Ollama: Ollama: Denial of Service via malformed image processing This vulnerability is rated Important for Red Hat because Ollama, when processing specially crafted base64-encoded image data via the /api/chat endpoint, is susceptible to a null pointer dereference. This flaw can be exploited by a remote attacker, leading to a denial of service condition where the model becomes unavailable until the service is restarted. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.