EUVD-2026-39786
GHSA-c839-jg98-xwx3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable API path triggers a heap read (AV:N/AC:L/PR:N/UI:N) yielding high confidentiality loss only, with no integrity or availability impact.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap memory, potentially leading to sensitive data exposure, further compromise, and stealthy persistence.
AnalysisAI
Information disclosure in Ollama's model quantization engine (confirmed affected in v0.13.5) allows remote, unauthenticated attackers to read and exfiltrate the server's heap memory, exposing sensitive in-process data such as model contents, API keys, or other secrets resident in memory. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation against an exposed Ollama instance with no authentication. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Ollama is a popular runtime for serving and managing large language models locally, exposing an HTTP API (default port 11434) for model operations. The vulnerability resides in its model quantization engine - the component that converts model weights to lower-precision formats. The description indicates a memory-disclosure flaw consistent with an out-of-bounds read / improper memory-handling class (CWE-125/CWE-200), where crafted input to the quantization path causes the server to return adjacent heap memory rather than only the intended data. No CWE was assigned in the source data, so the precise root cause (e.g., missing bounds check vs. uninitialized buffer) is inferred from the 'read and exfiltrate heap memory' wording rather than confirmed by vendor analysis. The affected product is identified by CPE cpe:2.3:a:ollama_ai:ollama, with EUVD confirming Ollama v0.13.5.
RemediationAI
No vendor-released patch version is identified in the provided data, so a specific fixed release cannot be cited - monitor the CERT/CC note (https://kb.cert.org/vuls/id/518910) and the vendor site (https://ollama.com) for an updated build superseding v0.13.5 and upgrade as soon as one is published. As compensating controls in the interim: ensure Ollama binds only to localhost (OLLAMA_HOST=127.0.0.1) rather than 0.0.0.0, which neutralizes the AV:N network vector for hosts that do not need remote access; if remote access is required, place the API behind an authenticating reverse proxy or VPN and restrict source IPs via firewall to block port 11434 from untrusted networks; and avoid invoking the model quantization functionality on untrusted or attacker-influenced input until a fix is available. The trade-off of localhost-only binding is loss of legitimate remote API access; the trade-off of a fronting proxy is added operational complexity and latency.
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path,
Denial of service in Ollama's multi-modal image processing (versions 0.11.5-rc0 through 0.13.5) lets remote attackers cr
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 8.2), this vulnerability is remotely exploita
A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function rea
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder [CVSS 7.5 HIGH]
A divide by zero vulnerability exists in ollama/ollama version v0.3.3. Rated high severity (CVSS 7.5), this vulnerabilit
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to create a customized GGUF model file that,
A vulnerability in Ollama versions <=0.3.14 allows a malicious user to create a customized gguf model file that can be u
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
An issue was discovered in Ollama before 0.1.34. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today