Description

A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.31.2-rc1 is capable of addressing this issue. The patch is named 67b6a1c2d45321e0cb3c04a18073f9818de7724b. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-07T09:17:17.470Z",
  "pubdate": "2026-09-07T09:17:17.470Z",
  "executiveSummary": "A critical integer overflow vulnerability exists within the GGUF Decoder component of Ollama, specifically affecting the readGGUFV1String function.\nThis vulnerability allows a remote attacker to trigger an overflow condition during the parsing of malformed GGUF model files.\nSuccessful exploitation could lead to arbitrary code execution, memory corruption, or a denial-of-service state depending on how the overflow affects memory allocation and buffer management.\nThe vulnerability impacts Ollama versions up to 0.31.1.\nGiven that the exploit has been publicly disclosed, the risk profile is elevated, necessitating immediate patching.\nThe attack vector is remote, meaning no local access to the host system is required to initiate the exploit sequence.\nThe vulnerability arises from insufficient boundary validation when handling string lengths within the GGUF file format specification.",
  "technicalDetails": "The vulnerability resides in the readGGUFV1String function located in the file fs/ggml/gguf.go. This function is responsible for parsing string data from GGUF format files, which are commonly used to store machine learning model weights.\nThe root cause is an integer overflow occurring during the calculation of buffer sizes or string lengths derived from the GGUF file header metadata. When the decoder reads a length value from a malicious GGUF file, it fails to perform adequate bounds checking before performing arithmetic operations or memory allocation.\nAn attacker can craft a malicious GGUF file with specifically manipulated length fields. When readGGUFV1String processes this file, the integer overflow causes the application to allocate an insufficient amount of memory for the incoming string data.\nSubsequent copy or read operations into this undersized buffer lead to a heap-based or stack-based buffer overflow. This corruption can overwrite adjacent memory segments, including control structures or function pointers, potentially redirecting execution flow to attacker-controlled payloads.\nThe exploitation process follows a sequential flow: First, the attacker provides a GGUF file to the Ollama service, often via a model loading request or a URI that triggers the GGUF parser. Second, the parser enters the readGGUFV1String function to process a string field. Third, the manipulated length field triggers the integer overflow, resulting in a wrap-around of the integer type used for allocation logic. Fourth, the application attempts to copy data into the undersized buffer, causing an out-of-bounds write operation.\nBecause the service processes these model files, the vulnerability is reachable remotely without requiring prior authentication or specific system privileges. This makes it a high-impact vector for remote code execution.\nThe failure to validate the input length against the maximum allowable memory bounds allows the attacker to bypass standard input sanitation, leading to successful memory corruption. This exploit is particularly dangerous as it targets a core component responsible for file ingestion, a routine operation in Ollama's model-serving workflow."
}