Database/AI/ML frameworks & serving
Ollama: integer overflow in the GGUF v1 string reader when parsing a crafted model file
Impact
Parsing a model file overflows a length computation in the GGUF v1 string reader. The record limits the consequence to availability (VA:L, scored 2.1) and requires that someone load the file, so this is a crash rather than a code-execution path on the evidence available. It matters where Ollama runs as a shared endpoint that lets users pull arbitrary models from public registries: a crafted file takes the daemon down and drops every other session on that GPU with it. An exploit has been published.
Who can reach it
Anyone who can get the Ollama host to load a model file they control - a pull from an untrusted registry, or a tenant-supplied path in a shared deployment. Requires that load step to happen (UI:P); no authentication beyond whatever gates model pulls.
What to do
Upgrade to 0.31.2-rc1 or later, which carries commit 67b6a1c. Restart the ollama daemon; models reload on the next request, so this is a service blip rather than a node action. Until then, restrict which registries and paths the daemon will load models from.
References
Related entries
- vLLM: attacker-supplied chat_template burns server resources on the GPU nodeCVE-2026-90878 · vLLM OpenAI-compatible server (/v1/chat/completions Jinja chat_template rendering)Low
- PowerInfer: unvalidated data_offset in the GGUF parser causes an out-of-bounds read when loading a modelCVE-2026-108955 · PowerInfer GGUF parser (gguf_init_from_file, data_offset)Low
- PowerInfer: out-of-bounds read in the CUDA FFN GPU-split loader while staging weights to the deviceCVE-2026-108960 · PowerInfer CUDA FFN GPU-split loader (create_striped_mat_to_gpu)Low
- vLLM: malformed tiktoken vocab file crashes the tokenizer backend, denying service on the GPU nodeCVE-2026-90713 · vLLM (Rust tiktoken vocab file handler, TiktokenTokenizer::new)Low
- LangChain4j agentic: unsafe Jackson default typing in AgenticScope deserialization allows arbitrary class instantiationCVE-2026-97869 · LangChain4j agentic module (AgenticScopeSerializer JSON deserialization)Low
- Langchain-Chatchat: arbitrary file write outside the upload and knowledge-base directoriesCVE-2026-51882 · Langchain-Chatchat (file upload and knowledge-base endpoints, path traversal)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.