A flaw was discovered in Ollama’s GGUF Decoder, specifically in the readGGUFV1String function of fs/ggml/gguf.go, where an integer overflow can be triggered by a crafted GGUF file. The overflow can corrupt internal counters and memory, allowing an attacker to alter program flow or cause a crash. The vulnerability can be exploited remotely by feeding maliciously crafted GGUF files to an affected instance, potentially resulting in denial of service or unintended behavior. The weakness corresponds to CWE-189 and CWE-190.

Ollama versions up to and including 0.31.1 are affected. The vulnerability resides in the core Ollama application that decodes GGUF model files. Users of Ollama 0.31.2-rc1 or newer are protected, as the commit identified in the patch resolves the integer overflow in the decoder.

The CVSS score of 5.3 classifies the flaw as medium severity, and the EPSS score is not available, but the weakness is publicly exploitable. As the exploit is already in the public domain and the attack vector requires only delivery of a malicious GGUF file, the risk for systems that load untrusted GGUF files remains significant. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the public availability of an exploit lowers the bar for attackers.