CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader

What it is

Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file's actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer.

How to check

1. Affected: github.com/ollama/ollama (go) < 0.17.1.
2. Compare your installed version with the range above (command below).

How to fix

1. Upgrade github.com/ollama/ollama to 0.17.1 or later.

ollama --version

Sources

• GitHub Security Advisory GHSA-x8qc-fggm-mpqg ↗
• NVD: CVE-2026-7482 ↗