Loading story…
CERT/CC disclosed VU#518910 for an Ollama vulnerability that lets unauthenticated remote attackers leak sensitive data from server heap memory through the platform’s model upload feature. The issue, tracked as CVE-2026-5757, affects Ollama’s handling of specially crafted GGUF model files and was reported by researcher Jeremy Brown, who found that malformed uploads could trigger unsafe memory access and expose heap contents during model processing.
Reporting said the flaw stems from improper bounds checking in Go code and the creation of a new model layer that can exfiltrate leaked memory through Ollama’s registry API. With no vendor patch available at disclosure and the vendor reportedly unreachable, CERT/CC urged organizations to disable model uploads where possible, restrict Ollama access to trusted local networks, block untrusted external IP addresses, and accept uploads only from verified sources.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
A new vulnerability, CVE-2026-7482, was disclosed affecting Ollama versions before 0.17.1, where crafted GGUF tensor metadata can trigger a heap out-of-bounds read via the unauthenticated /api/create endpoint and leak server memory. The reference indicates the issue is fixed in version 0.17.1 and notes possible exfiltration through the unauthenticated /api/push endpoint.
At the time of disclosure, no vendor patch was available and the vendor was reportedly unreachable. CERT/CC advised defenders to disable model uploads where possible, restrict access to trusted local networks, block untrusted external IPs, and accept uploads only from verified sources.
Security researcher Jeremy Brown publicly disclosed CVE-2026-5757 on April 22, 2026, describing an unauthenticated remote memory leak via Ollama's model upload interface. The flaw involves specially crafted GGUF model files that can expose sensitive heap memory data.
CERT/CC published vulnerability note VU#518910 describing a remote memory leak issue in Ollama related to GGUF quantization/model handling. The advisory established the issue as a tracked vulnerability by February 9, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcerunzero.com
Open sourcecvefeed.io
Open sourcecybersecuritynews.com
Open sourcekb.cert.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oligo Security disclosed six issues in **Ollama**, the open-source platform for serving large language models locally and remotely. Four received CVE identifiers: `CVE-2024-39719`, `CVE-2024-39720`, `CVE-2024-39721`, and `CVE-2024-39722`. The reported flaws affect the CreateModel and push APIs and can allow application crashes, resource-exhaustion denial of service, and disclosure of whether files exist on the host. Ollama fixed `CVE-2024-39720`, `CVE-2024-39721`, and `CVE-2024-39722` in version 0.1.46, while Oligo said `CVE-2024-39719` remained unresolved in version 0.3.14. Oligo also identified unauthenticated pull and push management endpoints as potential routes for model poisoning and model theft, although Ollama maintainers disputed those findings as vulnerabilities. The researchers estimated about 10,000 internet-exposed Ollama IP addresses and assessed roughly one quarter as vulnerable to the reported issues.
Sep 3, 2026
Researchers disclosed multiple serious security issues affecting AI tooling, led by critical vulnerabilities in **Ollama** that can expose systems and data. Wiz reported `CVE-2024-37032` (**Probllama**), an easy-to-exploit remote code execution flaw caused by improper validation of model manifests from private registries, allowing path traversal, arbitrary file read/write, and code execution—especially in Docker deployments running as root and listening on `0.0.0.0` without authentication. A separate disclosure described `CVE-2026-7482` (**Bleeding Llama**), which can leak heap memory through Ollama’s GGUF model creation and quantization workflow and exfiltrate the resulting artifact via the `/api/push` endpoint, while `CVE-2026-42248` and `CVE-2026-42249` affect the Windows updater and can be chained for persistent code execution through missing signature checks and unsafe `ETag` handling. The disclosures landed alongside a software supply chain incident on **Hugging Face**, where a malicious repository impersonating OpenAI’s Privacy Filter reportedly climbed to the platform’s trending list and drew more than 240,000 downloads before removal. The fake package used cloned documentation and likely inflated engagement metrics to appear legitimate, then delivered a multi-stage Windows infection that gained **SYSTEM**-level persistence, disabled security controls, and deployed the Rust-based stealer **sefirah** to collect wallet data, Discord tokens, developer credentials, browser secrets, screenshots, and sensitive files for exfiltration. Together, the incidents show how exposed AI infrastructure, weak authentication defaults, and trust in popular model and code repositories are creating high-impact attack paths; defenders were urged to upgrade Ollama to fixed versions, avoid direct internet exposure, use authenticated reverse proxies, and scrutinize third-party AI packages before deployment.
Jun 29, 2026
CERT Polska disclosed two vulnerabilities in **Ollama for Windows**—`CVE-2026-42248` and `CVE-2026-42249`—that affect tested versions `0.12.10` through `0.17.5` and expose the software’s update mechanism to malicious payloads. According to the advisory, the first flaw causes the Windows updater to accept downloaded executables without properly verifying their integrity or authenticity, while the second lets attacker-controlled HTTP response headers influence file path construction, enabling path traversal and arbitrary file writes. CERT Polska said an attacker able to tamper with update responses could combine the bugs to stage and run unauthorized code during Ollama’s silent automatic update process. The chained attack could allow malicious executables to be written into sensitive locations such as the **Windows Startup** directory, resulting in automatic and persistent code execution without user awareness. CERT Polska credited Bartłomiej Dmitruk of **striga.ai** with the report and said maintainers were notified early, but no vendor details on the vulnerabilities or affected versions were provided. Separate reporting later listed the Ollama issues among a broader set of publicly validated CVEs attributed by Striga’s tracker, while noting that the AI-assisted discovery claims were self-reported rather than independently confirmed by upstream vendors.
Jul 20, 2026