EUVD-2026-39786
GHSA-c839-jg98-xwx3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed Ollama API (port 11434)
-
DeliverySend crafted quantization request
-
ExploitTrigger out-of-bounds heap read
-
ExecutionExfiltrate leaked memory contents
-
ImpactHarvest secrets for further compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Ollama HTTP API be network-reachable by the attacker and that a request reach the model quantization engine code path; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special privileges are needed once the endpoint is reachable. The principal limiting factor is network exposure: Ollama commonly binds to localhost by default, so instances not deliberately exposed to a network (via OLLAMA_HOST=0.0.0.0, container port mapping, or a proxy) are not remotely reachable. The disclosed data is also non-deterministic - heap contents vary by runtime state - so what an attacker obtains depends on what secrets happen to reside in process memory at exploit time. |
| Impact | Risk signals are partly favorable to defenders and partly concerning. The CVSS 3.1 base of 7.5 (HIGH) reflects network reach, low complexity, and no privileges or user interaction - meaning any reachable Ollama endpoint is exploitable, with impact limited to confidentiality (C:H, I:N, A:N). However, no EPSS score was provided in the input, the issue is NOT in CISA KEV (no confirmed active exploitation), and no POC/exploit code is referenced - so this is a high-CVSS issue without current evidence of weaponization. The real-world exposure hinges on deployment posture: Ollama is frequently bound to localhost by default, which sharply limits the AV:N vector in typical installs; the high score materializes mainly where operators have exposed the API to a network or the internet. EPSS data is missing, so probabilistic exploitation likelihood cannot be quantified - treat the 7.5 as a ceiling that is realized only for network-exposed instances. |
| Exploit ScenarioDerived | An attacker locates an Ollama instance whose API (port 11434) is reachable over the network, then sends a crafted request that drives the quantization engine to return heap memory beyond the intended buffer. The leaked memory may contain model data, credentials, or other secrets, which the attacker repeatedly harvests to enable further compromise. No public exploit is referenced, so this scenario is constructed from the CVSS vector (network, low complexity, no auth) and the description rather than an observed in-the-wild technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
Information disclosure in Ollama's model quantization engine (confirmed affected in v0.13.5) allows remote, unauthenticated attackers to read and exfiltrate the server's heap memory, exposing sensitive in-process data such as model contents, API keys, or other secrets resident in memory. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation against an exposed Ollama instance with no authentication. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the provided data, so a specific fixed release cannot be cited - monitor the CERT/CC note (https://kb.cert.org/vuls/id/518910) and the vendor site (https://ollama.com) for an updated build superseding v0.13.5 and upgrade as soon as one is published. As compensating controls in the interim: ensure Ollama binds only to localhost (OLLAMA_HOST=127.0.0.1) rather than 0.0.0.0, which neutralizes the AV:N network vector for hosts that do not need remote access; if remote access is required, place the API behind an authenticating reverse proxy or VPN and restrict source IPs via firewall to block port 11434 from untrusted networks; and avoid invoking the model quantization functionality on untrusted or attacker-influenced input until a fix is available. The trade-off of localhost-only binding is loss of legitimate remote API access; the trade-off of a fronting proxy is added operational complexity and latency.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ollama is a popular runtime for serving and managing large language models locally, exposing an HTTP API (default port 11434) for model operations. The vulnerability resides in its model quantization engine - the component that converts model weights to lower-precision formats. The description indicates a memory-disclosure flaw consistent with an out-of-bounds read / improper memory-handling class (CWE-125/CWE-200), where crafted input to the quantization path causes the server to return adjacent heap memory rather than only the intended data. No CWE was assigned in the source data, so the precise root cause (e.g., missing bounds check vs. uninitialized buffer) is inferred from the 'read and exfiltrate heap memory' wording rather than confirmed by vendor analysis. The affected product is identified by CPE cpe:2.3:a:ollama_ai:ollama, with EUVD confirming Ollama v0.13.5.
Know when Ollama gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable API path triggers a heap read (AV:N/AC:L/PR:N/UI:N) yielding high confidentiality loss only, with no integrity or availability impact.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap memory, potentially leading to sensitive data exposure, further compromise, and stealthy persistence.
Executive ViewAI
Ollama v0.13.5 contains a critical information disclosure vulnerability in its model quantization engine that allows remote, unauthenticated attackers to extract sensitive data directly from server memory, including API keys, model weights, and other secrets. Organizations operating exposed Ollama instances face immediate risk of unauthorized data exfiltration without requiring authentication or user interaction. This poses a direct threat to the confidentiality of proprietary models and stored credentials.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce network-level access controls-restrict Ollama to private networks or behind VPN authentication; (2) Disable remote API exposure; air-gap instances if feasible; (3) Rotate all in-process credentials immediately and frequently; (4) Implement network intrusion detection focused on unusual data exfiltration patterns; (5) Consider temporary service suspension for non-critical deployments until patch releases; (6) Monitor process memory access and audit all external connections.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path,
Remote code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) lets an attacker who can influence HTTP up
Silent auto-update code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) stems from an update-verificat
Remote denial of service in Ollama (HEAD f0078ae) allows unauthenticated attackers to crash the entire server by uploadi
Denial of service in Ollama's multi-modal image processing (versions 0.11.5-rc0 through 0.13.5) lets remote attackers cr
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 8.2), this vulnerability is remotely exploita
A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function rea
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder [CVSS 7.5 HIGH]
A divide by zero vulnerability exists in ollama/ollama version v0.3.3. Rated high severity (CVSS 7.5), this vulnerabilit
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to create a customized GGUF model file that,
Exploit-DB