Database/AI/ML frameworks & serving
Ollama: integer overflow in the GGUF v1 string reader when parsing a crafted model file
Impact
Parsing a model file overflows a length computation in the GGUF v1 string reader. The record limits the consequence to availability (VA:L, scored 2.1) and requires that someone load the file, so this is a crash rather than a code-execution path on the evidence available. It matters where Ollama runs as a shared endpoint that lets users pull arbitrary models from public registries: a crafted file takes the daemon down and drops every other session on that GPU with it. An exploit has been published.
Who can reach it
Anyone who can get the Ollama host to load a model file they control - a pull from an untrusted registry, or a tenant-supplied path in a shared deployment. Requires that load step to happen (UI:P); no authentication beyond whatever gates model pulls.
What to do
Upgrade to 0.31.2-rc1 or later, which carries commit 67b6a1c. Restart the ollama daemon; models reload on the next request, so this is a service blip rather than a node action. Until then, restrict which registries and paths the daemon will load models from.
References
Related entries
- llama.cpp: a crafted GGUF file trips a reachable assertion and aborts the process loading itCVE-2026-52131 · llama.cpp (gguf_reader::read GGUF model file parser)Unscored
- llama.cpp server: negative top_n on /rerank drives an unbounded allocation and denial of serviceCVE-2026-52132 · llama.cpp server /rerank endpoint (top_n handling under --reranking)Unscored
- Hugging Face Transformers: load_custom_generate writes remote code to disk before the trust checkCVE-2026-80047 · Hugging Face Transformers (dynamic_module_utils.py, load_custom_generate remote-code cache)Unscored
- Jupyter Notebook (untrusted notebooks): Untrusted notebook executes JavaScript in the user's session on openCVE-2021-32798 · Jupyter Notebook (untrusted notebooks)Critical
- MLflow: Absolute path traversal prior to 2.5.0CVE-2023-3765 · MLflowCritical
- TorchServe: Unauthenticated SSRFCVE-2023-43654 · TorchServeCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.