CVE-2025-15514

Executive Summary

CVE-2025-15514 is a critical null pointer dereference vulnerability in Ollama versions 0.11.5-rc0 through 0.13.5. The flaw resides in the multi-modal model image processing functionality, specifically within the /api/chat endpoint. When processing base64-encoded image data, the application fails to validate that the decoded data represents valid media before passing it to the mtmd_helper_bitmap_init_from_buf function. This function can return NULL for malformed input, but the code does not check this return value before dereferencing the pointer in subsequent operations. A remote attacker can exploit this by sending specially crafted base64 image data that decodes to invalid media, causing a segmentation fault and crashing the runner process. This results in a denial of service condition where the model becomes unavailable to all users until the service is restarted.

Supply Chain & Package Security

Ollama is distributed as a standalone binary and via package managers for various operating systems. The vulnerability affects all distributions of Ollama within the vulnerable version range. Users should verify their version and apply any available updates or mitigations.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions are required for exploitation.
• Privileges Required (PR): None - No authentication is needed.
• User Interaction (UI): None - The victim does not need to perform any action.
• Scope (S): Unchanged - The impact is confined to the vulnerable component.
• Confidentiality (C): None - No data is exposed.
• Integrity (I): None - No data is modified.
• Availability (A): High - The vulnerability causes a denial of service, making the model unavailable.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication, leading to a complete denial of service.

Deep Dive & Mechanics

The vulnerability is a classic null pointer dereference (CWE-476) in the multi-modal image processing pipeline of Ollama. The flow is as follows:

1. Request Handling: The /api/chat endpoint accepts a JSON payload containing a messages array. Each message can include an images array with base64-encoded image data.
2. Decoding: The application decodes the base64 string into raw binary data.
3. Validation Failure: The code does not validate that the decoded binary data represents a valid image format (e.g., PNG, JPEG, GIF) before passing it to the image processing function.
4. Null Return: The mtmd_helper_bitmap_init_from_buf function is called with the raw binary data. If the data is malformed (e.g., truncated, corrupted, or not a valid image), this function returns a NULL pointer.
5. Dereference: The return value of mtmd_helper_bitmap_init_from_buf is not checked for NULL. The code immediately dereferences the pointer to access fields of the bitmap structure, causing a segmentation fault.

Root Cause: Missing input validation and missing NULL check on the return value of a critical function.

Impact: The segmentation fault crashes the runner process, which is responsible for serving the model. This makes the model unavailable to all users until the Ollama service is manually restarted.

Vulnerable vs. Patched Code

The vulnerable code path is in the image processing module. The exact location is in the function that handles the /api/chat endpoint's image data.

Vulnerable Code (Conceptual):

// Vulnerable: No NULL check on return value
bitmap_t *bitmap = mtmd_helper_bitmap_init_from_buf(image_data, image_size);
// Direct dereference without check
int width = bitmap->width;
int height = bitmap->height;

Patched Code (Conceptual):

// Patched: NULL check added
bitmap_t *bitmap = mtmd_helper_bitmap_init_from_buf(image_data, image_size);
if (bitmap == NULL) {
    // Handle error: return error response to client
    return json_error("Invalid image data");
}
int width = bitmap->width;
int height = bitmap->height;

The patch adds a NULL check after the call to mtmd_helper_bitmap_init_from_buf. If the function returns NULL, the code returns an error response instead of crashing.

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service by crashing the Ollama runner process.

Prerequisites:

• Access to an Ollama instance with a multi-modal model loaded (e.g., LLaVA, BakLLaVA).
• The target Ollama version must be between 0.11.5-rc0 and 0.13.5.

Exploit Steps:

1. Identify Target: Find an Ollama instance. This can be done via Shodan using the dork "ollama" or by scanning for port 11434.
2. Craft Payload: Create a JSON payload for the /api/chat endpoint with a malformed base64 image. The base64 string should decode to invalid image data (e.g., random bytes, truncated data, or a non-image file header).
3. Send Request: Send the crafted payload to the target.

Example Payload:

{
  "model": "llava",
  "messages": [
    {
      "role": "user",
      "content": "Describe this image",
      "images": ["aW52YWxpZCBkYXRh"]
    }
  ]
}

Note: The base64 string aW52YWxpZCBkYXRh decodes to "invalid data", which is not a valid image format.

Expected Result: The Ollama runner process crashes, and subsequent requests to the model return errors until the service is restarted.

Blue Team

Detection:

• Monitor for repeated requests to /api/chat with malformed base64 image data.
• Look for crash logs or segmentation fault errors in the Ollama logs.
• Monitor for sudden unavailability of multi-modal models.

Mitigation:

• Restrict access to the /api/chat endpoint to trusted IPs or networks.
• Implement a Web Application Firewall (WAF) rule to block requests with suspiciously small or malformed base64 image data.
• Monitor the Ollama process and automatically restart it if it crashes.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /api/chat with an images array containing base64 strings that decode to invalid image data.
  • Repeated 500 Internal Server Error responses from the /api/chat endpoint.
• System:
  • Segmentation fault (SIGSEGV) in the Ollama runner process.
  • Crash logs containing references to mtmd_helper_bitmap_init_from_buf.
  • Ollama service logs showing "runner process exited unexpectedly".
• File:
  • Core dump files generated by the crashed runner process.

Detection Engineering

YARA Rule

rule CVE_2025_15514_Ollama_Null_Pointer_Dereference {
    meta:
        description = "Detects malformed base64 image data in Ollama /api/chat requests"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-15514"
        severity = "high"
    strings:
        $json_key = "images" nocase
        $base64_pattern = /[A-Za-z0-9+\/]{1,}={0,2}/
    condition:
        $json_key and #base64_pattern > 0
}

Sigma Rule

title: CVE-2025-15514 - Ollama Null Pointer Dereference via Malformed Image
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to Ollama /api/chat with malformed base64 image data
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: ollama
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/chat'
        cs-uri-query|contains: 'images'
    condition: selection
falsepositives:
    - Legitimate requests with valid images
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-15514 - Ollama Null Pointer Dereference via Malformed Image";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/chat";
    http_uri;
    content:"images";
    http_client_body;
    pcre:"/[A-Za-z0-9+\/]{1,}={0,2}/";
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit access to the /api/chat endpoint to trusted IP addresses or networks using a firewall or reverse proxy.
2. Monitor and Restart: Implement a monitoring system that automatically restarts the Ollama service if the runner process crashes.
3. Input Validation: If possible, implement a reverse proxy or WAF that validates the base64 image data before forwarding it to Ollama.

Long-Term Fix:

• Upgrade: Monitor the Ollama project for a patched version. Once available, upgrade to the latest version.
• Patch: If you have access to the source code, apply the conceptual patch described in the "Vulnerable vs. Patched Code" section.

Workaround:

• Disable multi-modal models if they are not required for your use case.

Valters IT