CVE-2026-7482

[CVE catalog]

Severity

Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Published

May 4, 2026, 12:38:28 PM UTC

Source

[NVD] · [CVE record]

EPSS

2.24% · Oct 25, 2026

A flaw was found in Ollama. A remote attacker can exploit a heap out-of-bounds read vulnerability in the GGUF model loader by providing a specially crafted GGUF (GGML Unified Format) file to the /api/create endpoint. This allows the attacker to read beyond the allocated memory buffer, potentially disclosing sensitive information such as environment variables, API keys, system prompts, and user conversation data. The leaked data can then be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. Both /api/create and /api/push endpoints lack authentication in the upstream distribution, increasing the risk of exploitation. github.com/ollama/ollama: ollama: Ollama: Information disclosure via heap out-of-bounds read in GGUF model loader An Important information disclosure flaw exists in Ollama, allowing a remote, unauthenticated attacker to read heap memory via a crafted GGUF file submitted to the /api/create endpoint. This can expose sensitive data, including API keys and user conversation data, which can then be exfiltrated. While default deployments bind to localhost, configurations exposing Ollama to the public internet significantly increase the risk. In this flaw a network attacker may leak sensitive data (C:H, I:N) with limited scope of system denial of servci (A:L), where a system reboot may not be the scenario. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.