The vulnerability is a heap out‑of‑bounds read triggered during GGUF model loading in Ollama. An attacker can supply a GGUF file in which the declared tensor offset and size surpass the actual file length. The server then reads past the allocated buffer, exposing arbitrary memory contents that may contain environment variables, API keys, system prompts, and conversation data of concurrent users. The leaked data can be exfiltrated by uploading the resulting model artifact through the unrestricted /api/push endpoint. This results in a remote information disclosure that can compromise secrets and user data.

The flaw exists in Ollama prior to version 0.17.1, affecting all installations of the ollama:ollama product. Default deployments bind the service to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 setting is widely used, exposing the endpoints to the public Internet. Systems running any version earlier than 0.17.1 should be considered vulnerable until a patch is applied.

The CVSS score of 8.8 classifies the issue as high severity. The EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated remote access via the /api/create and /api/push endpoints, which have no built‑in authentication in upstream distributions. An attacker can craft a malicious GGUF file, trigger the vulnerable read, and recover sensitive memory contents before exfiltrating them through the push endpoint to an attacker-controlled registry. Because the attack does not require privileged access, the potential impact is felt by all users and components that the vulnerable server exposes.