Critical Memory Leak in Ollama

Cyera Research disclosed CVE-2026-7482 (CVSS 9.1) in Ollama. An attacker can exploit the model creation path without authentication to read the entire Ollama process memory, and the exposed scope includes user prompts, system prompts, and environment variables.

The vulnerability occurs during the process of converting an uploaded GGUF file into a model.

• /api/create reads the GGUF and turns it into a Layer, then performs quantization if needed.
• WriteTo calls ConvertToF32 based on the element count computed by Elements(), instead of the tensor's actual byte size.
• If an attacker manipulates the GGUF's shape values to be abnormally large, a heap out-of-bounds read occurs, exceeding the actual buffer.
• The read memory can be converted and saved again, getting mixed into the model file, allowing sensitive information to be leaked continuously.

The root cause is Go's use of unsafe combined with a design that fails to verify whether the shape values match the actual data size. The article claims that roughly 300,000 servers worldwide may be affected.