Ollama
CVE-2025-15514
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V16 - Security Logging and Error Handling NullPointerException catch
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jun 30, 2026
Denial of service in Ollama's multi-modal image processing (versions 0.11.5-rc0 through 0.13.5) lets remote attackers crash the model runner by POSTing crafted base64 image data to the /api/chat endpoint. The decoded data is passed to mtmd_helper_bitmap_init_from_buf without validating that it is valid media; the function returns NULL on malformed input and the unchecked pointer is dereferenced, triggering a segmentation fault that takes the model offline for all users until restart. Rated CVSS 4.0 8.7 (availability-only impact); publicly available exploit code exists via a Huntr bounty, but EPSS is low (0.09%, 25th percentile) and it is not on CISA KEV.
Earlier versions of this analysis (4)
Denial of service in Ollama 0.11.5-rc0 through 0.13.5 lets a remote attacker crash the model runner by posting crafted base64 image data to the /api/chat endpoint of a server running a multi-modal (vision) model. The decoded data is passed to mtmd_helper_bitmap_init_from_buf without checking its NULL return, so malformed media triggers a NULL pointer dereference and segmentation fault, taking the model offline for all users until restart. Publicly available exploit code exists (huntr bounty); EPSS is low (0.09%) and the issue is not in CISA KEV.
Denial of service in Ollama versions 0.11.5-rc0 through 0.13.5 lets a remote attacker crash the model runner by posting malformed base64 image data to the /api/chat multi-modal endpoint. Because the code dereferences a NULL return from mtmd_helper_bitmap_init_from_buf without validation, a single crafted request segfaults the runner and makes the served model unavailable to all users until restart. Publicly available exploit code exists (huntr bounty report), though EPSS is low (0.09%, 25th percentile) and it is not on CISA KEV.
Denial of service in Ollama 0.11.5-rc0 through 0.13.5 lets remote clients crash the model runner by submitting malformed base64 image data to the multi-modal /api/chat endpoint. Because mtmd_helper_bitmap_init_from_buf returns NULL for invalid media and the result is dereferenced unchecked, a single crafted request triggers a segmentation fault that takes the model offline for all users until restart. Publicly available exploit code exists (huntr bounty report); EPSS is low (0.09%) and the issue is not on CISA KEV, so this is a reliability/availability problem rather than a code-execution threat.
Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. [CVSS 7.5 HIGH]
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Ollama gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated low-complexity network request crashes the runner with availability-only impact, so PR:N/UI:N/A:H and C:N/I:N; AV:N reflects the API's network reachability when exposed.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
7DescriptionCVE.org
Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid media before passing it to the mtmd_helper_bitmap_init_from_buf function. This function can return NULL for malformed input, but the code does not check this return value before dereferencing the pointer in subsequent operations. A remote attacker can exploit this by sending specially crafted base64 image data that decodes to invalid media, causing a segmentation fault and crashing the runner process. This results in a denial of service condition where the model becomes unavailable to all users until the service is restarted.
Executive ViewAI
Ollama, an open-source model inference platform, is vulnerable to remote denial-of-service attacks in versions 0.11.5-rc0 through 0.13.5. An attacker can crash the model runner by posting malformed image data to the /api/chat endpoint, taking the inference service offline for all users until manual restart. Publicly available exploit code exists, though real-world exploitation risk remains low (EPSS 0.1%), and organizations running affected versions should prioritize network access controls and upgrade planning.
Within 24 hours: Identify all Ollama deployments running versions 0.11.5-rc0 through 0.13.5 and assess their exposure to untrusted networks. Within 7 days: Deploy network-level restrictions to the /api/chat endpoint via firewall or API gateway to allow only trusted internal sources, and begin testing upgrades to Ollama versions prior to 0.11.5-rc0 or later than 0.13.5. Within 30 days: Complete upgrade to a non-vulnerable version or confirm persistent rate limiting and request validation are in place.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict network access to /api/chat endpoint via firewall or API gateway to trusted internal sources only; (2) implement request-level rate limiting and payload size validation for image data; (3) upgrade to Ollama versions prior to 0.11.5-rc0 (e.g., 0.11.4) or later than 0.13.5; (4) enable request logging to detect exploitation attempts; (5) monitor model runner processes for unexpected crashes or service restarts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path,
Remote code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) lets an attacker who can influence HTTP up
Silent auto-update code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) stems from an update-verificat
Remote denial of service in Ollama (HEAD f0078ae) allows unauthenticated attackers to crash the entire server by uploadi
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 8.2), this vulnerability is remotely exploita
A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by
Information disclosure in Ollama's model quantization engine (confirmed affected in v0.13.5) allows remote, unauthentica
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function rea
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder [CVSS 7.5 HIGH]
A divide by zero vulnerability exists in ollama/ollama version v0.3.3. Rated high severity (CVSS 7.5), this vulnerabilit
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to create a customized GGUF model file that,
Exploit-DB