CVE-2026-7482 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-7482 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-7482 is a heap out-of-bounds read vulnerability in the GGUF model loader component of Ollama, the open-source local large language model runtime, affecting all versions prior to 0.17.1.

Technical Detail

The flaw exists in how Ollama's GGUF model loader processes attacker-supplied model files submitted via the /api/create endpoint. An attacker can craft a malicious GGUF file in which the declared tensor offset and associated size fields are manipulated to cause the application to read memory beyond the bounds of the allocated heap buffer. Depending on what memory is read and how the application handles the resulting data, this class of vulnerability can lead to sensitive memory disclosure, application crash, or in some cases provide primitives that facilitate further exploitation such as remote code execution, particularly in environments where the API endpoint is exposed without authentication controls.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is currently assessed as none, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. This status should be monitored closely given the severity score and the accessibility of the affected endpoint in many default Ollama deployments.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence. Organizations running Ollama instances with externally accessible APIs should treat this as an elevated risk regardless of current attribution gaps.

What To Do

Update Ollama to version 0.17.1 or later immediately, as this release contains the fix for the vulnerable GGUF model loader. Organizations that cannot patch immediately should restrict access to the /api/create endpoint using network-level controls such as firewall rules or reverse proxy authentication, ensuring the endpoint is not reachable from untrusted networks or the public internet. Audit existing Ollama deployments for exposure of the API port, which defaults to TCP 11434, and confirm that only trusted users and systems can submit model files. Monitor application logs for unexpected or malformed GGUF file submissions as a detection signal for potential exploitation attempts.