Executive Summary: Model File Ingestion as an Attack Vector

A serious vulnerability tracked as CVE-2026-86289 has been identified in Ollama, the widely adopted open-source framework used to run large language models (LLMs) locally on enterprise servers, edge clusters, and developer workstations. The defect is classified under CWE-190: Integer Overflow or Wraparound within the core GGUF (GPT-Generated Unified Format) binary parser.

Carrying a CVSS v3.1 base score of 8.8 (High), the flaw enables attackers to craft weaponized AI model weights that, when fetched or initialized by an Ollama instance, trigger arithmetic overflow during string allocation. This results in undersized heap buffer allocations followed by uncontrolled out-of-bounds writes, facilitating denial-of-service (daemon crash) and potential remote code execution (RCE) with the privileges of the Ollama runtime daemon.

Technical Deep-Dive: Overflow in readGGUFV1String (fs/ggml/gguf.go)

The GGUF container specification encodes model architectures, hyperparameter dictionaries, quantization scales, and tensor payloads into structured binary key-value mappings. When parsing string metadata records in legacy and contemporary format versions, Ollama invokes the readGGUFV1String parser routine in fs/ggml/gguf.go.

The vulnerable implementation reads a 64-bit unsigned integer representing the byte length of the incoming string value: 

// Vulnerable logic in fs/ggml/gguf.go (prior to commit 67b6a1c)
func (f *GGUF) readGGUFV1String(r io.Reader) (string, error) {
    var length uint64
    if err := binary.Read(r, binary.LittleEndian, &length); err != nil {
        return "", err
    }
    // Vulnerability: length is cast to integer without bound validation
    // If length approaches 2^64 - 1 or causes integer truncation on 32-bit platforms,
    // memory allocation buffers wrap around, resulting in heap out-of-bounds writes.
    buf := make([]byte, length)
    if _, err := io.ReadFull(r, buf); err != nil {
        return "", err
    }
    return string(buf), nil
}

When an adversary submits a model file where the string length header specifies an exorbitant value (such as 0xFFFFFFFFFFFFFFFF or values that wrap during internal pointer arithmetic calculations), Go's runtime memory allocator either panics with an unhandled exception or corrupts native runtime slice structures if CGo bridging components (e.g. llama.cpp dynamic libraries) interact with the parsed memory pointers.

Threat Vector: Public Hugging Face Repositories & API Ingestion

The attack vector is particularly acute for modern enterprise AI architectures:

  • Automated Agent Pull Pipelines: Many autonomous agent workflows (e.g., CrewAI, AutoGen, Langflow) allow dynamic model loading by specifying repository paths. An agent instructed to pull a customized fine-tuned model from an untrusted registry automatically downloads the malicious GGUF file.
  • Public Ollama API Exposure: An exposed Ollama HTTP daemon (listening by default on port 11434) that accepts unauthenticated POST /api/pull or POST /api/create requests can be compelled to download and unpack a malicious model directly from an attacker-controlled endpoint.

Vulnerability Assessment & Version Matrix

Software Package Impacted Releases Remediation Release Vulnerability Type
Ollama Daemon (Core) Versions ≤ 0.31.1 Ollama v0.31.2 / v0.31.2-rc1+ CWE-190 (Integer Overflow / Memory Corruption)
GGUF Go Parser Module fs/ggml/gguf.go (All prior commits) Commit 67b6a1c2d45321e0cb3c04a18073f9818de7724b Unbounded slice allocation check

Remediation & Defense-in-Depth Checklist

  1. Upgrade Ollama Binary Immediately: Pull the patched release directly from upstream: 
    # Upgrade via official install script
curl -fsSL https://ollama.com/install.sh | sh

# Verify installed daemon version
ollama --version
# Output must indicate version >= 0.31.2
  2. Bind Ollama API to Loopback Only: Ensure the service environment variable OLLAMA_HOST is explicitly constrained to 127.0.0.1:11434 rather than 0.0.0.0. 
    # Systemd override configuration (/etc/systemd/system/ollama.service.d/override.conf)
[Service]
Environment="OLLAMA_HOST=127.0.0.1:11434"
Environment="OLLAMA_ORIGINS=https://internal-app.corp.net"
  3. Cryptographic Model Integrity Verification: Enforce SHA-256 digest validation on all imported Modelfiles and GGUF quantization weights before registering them into local model stores.