CVE-2026-86289 in Ollama
Summary
by MITRE • 09/07/2026
A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.31.2-rc1 is capable of addressing this issue. The patch is named 67b6a1c2d45321e0cb3c04a18073f9818de7724b. It is recommended to upgrade the affected component.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability identified in Ollama versions up through 0.31.1 represents a critical security flaw within the GGUF Decoder component, specifically located in the readGGUFV1String function found in the fs/ggml/gguf.go file. This issue is classified as an integer overflow, which occurs when an arithmetic operation results in a number that cannot be represented within the allocated storage space for the variable involved. In this specific context, the flaw arises during the parsing of GGUF format files, where improper validation or handling of size fields can lead to miscalculations regarding memory allocation or buffer boundaries. The Common Weakness Enumeration (CWE) categorizes such issues under CWE-190 Integer Overflow or Wraparound and potentially CWE-787 Out-of-bounds Write if the overflow leads to writing data beyond allocated buffers, highlighting a fundamental failure in input validation and boundary checking within the application logic.
The operational impact of this vulnerability is significant due to its remote exploitability. An attacker can craft malicious GGUF model files that trigger the integer overflow when processed by Ollama. Since Ollama is frequently used as an inference engine for large language models, users often download or load model weights from various sources. If a user loads a compromised file, the resulting memory corruption could lead to application crashes, denial of service conditions, or potentially arbitrary code execution depending on how the overflowed values are utilized in subsequent operations. The fact that public exploits have been made available increases the risk landscape considerably, as it lowers the barrier for entry for threat actors who may not possess advanced reverse engineering skills but can leverage existing tools to target vulnerable instances.
This vulnerability aligns with several tactics and techniques within the MITRE ATT&CK framework. Specifically, it relates to Initial Access via T1566 Phishing if delivered through deceptive model files, or more accurately to Execution components like T1203 Exploitation for Client Execution if the user actively loads a malicious file. The core technical failure falls under CWE-787 Out-of-bounds Write and CWE-190 Integer Overflow, which are common precursors to memory corruption vulnerabilities such as buffer overflows. These weaknesses allow attackers to manipulate program flow or access sensitive memory regions that should remain protected by the operating system's security boundaries.
To mitigate this risk, immediate action is required for all systems running Ollama versions prior to 0.31.2-rc1. The recommended course of action is to upgrade the software to version 0.31.2-rc1 or later, which incorporates the patch identified by commit hash 67b6a1c2d45321e0cb3c04a18073f9818de7724b. This update addresses the root cause within the readGGUFV1String function by implementing stricter validation checks and ensuring that integer operations do not exceed expected bounds before memory allocation or data processing occurs. Organizations should also implement strict input sanitization policies for any GGUF files processed, verifying their integrity against known good hashes where possible to prevent the loading of tampered model weights from untrusted sources until all instances are fully patched.