Ollama EUVD-2026-46642

Exploitation requires network reachability to Ollama's HTTP API and the ability to call the blob upload endpoint together with the model create or pull endpoint - the specific features that ingest and parse the attacker-supplied GGUF file. The malicious input is a small (sub-1KB) crafted GGUF file carrying oversized values in any of three specific parser fields: string lengths, tensor dimension counts, or metadata array element counts. Per CVSS PR:N/UI:N/AC:L, no authentication, no user interaction, and no special product configuration are needed against a default Ollama deployment whose API is exposed to the attacker. The primary limiting factor is exposure, not configuration: if the Ollama API is bound to localhost or restricted behind authenticated network controls, an external attacker cannot reach the vulnerable endpoints. Impact is limited to availability (server crash) - no code execution, data disclosure, or integrity loss.

The signals are internally consistent and point to a genuine, easily reachable availability threat that is nonetheless bounded to denial of service. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) confirms network reachability, low complexity, no privileges, and no user interaction, with impact limited entirely to availability (VA:H) and zero confidentiality or integrity impact - matching the description of a crash-only bug with no code execution or data exposure. The base score of 8.7 is high precisely because the availability hit is total (whole-process crash) and trivially triggered. No EPSS score was provided, and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; no public POC is referenced either. The practical risk therefore hinges on exposure: an Ollama instance whose API is reachable by untrusted clients is at high, one-shot DoS risk, while an instance bound to localhost or behind authenticated network controls faces low real-world risk. The one caveat to verify: PR:N assumes the create/pull/blob endpoints are reachable without authentication, which is true of default Ollama deployments but may not hold where a proxy enforces auth - confirm your deployment's exposure.

An attacker who can reach an internet- or LAN-exposed Ollama API crafts a sub-1KB GGUF file that declares a huge string length or metadata array count, uploads it via the blob endpoint, and references it through the model create or pull API. When Ollama parses the header it attempts a massive allocation, hitting a Go OOM fatal error or makeslice panic that bypasses recovery middleware and crashes the entire server - a low-complexity, unauthenticated, single-request takedown requiring no user interaction, though no public POC is identified at time of analysis.