CVE-2026-86289

Executive Summary

CVE-2026-86289 is an integer overflow vulnerability affecting the GGUF (GPT-Generated Unified Format) decoder component of Ollama, an open-source large language model (LLM) runtime, in versions up to and including 0.31.1. The flaw resides in the readGGUFV1String function within the fs/ggml/gguf.go file, allowing a remote attacker to trigger an integer overflow during model file metadata parsing. Successful exploitation can lead to a denial-of-service (DoS) condition via application crash or unexpected behavior when processing a maliciously crafted GGUF model file. The vulnerability carries a CVSS score of 4.3 (Medium), is remotely exploitable but requires user interaction (e.g., inducing a user to load a malicious model), and has no currently known in-the-wild exploitation activity.

Technical Analysis

The vulnerability class is an integer overflow (CWE-189) occurring within the GGUF binary model format parser. GGUF is the native file format used by Ollama to serialize and load LLM weights and metadata. The vulnerable code path is in the readGGUFV1String function, located in the Go source file fs/ggml/gguf.go.

Mechanism: The GGUF format stores strings with a preceding length prefix. The readGGUFV1String function reads this length field and allocates or copies data accordingly. An integer overflow occurs when the length value, read from the model file (or possibly from a crafted network stream where a model is being pulled), is manipulated to exceed the maximum integer boundary for the platform (typically 2^63-1 on 64-bit systems). When the arithmetic operation on the length value wraps around to a small or negative number, the subsequent bounds-checking logic is bypassed, leading to out-of-bounds memory reads or writes.

Attack Surface: The attack surface is the GGUF decoding routine, which is invoked whenever Ollama loads a model file. Two primary vectors exist:

1. Local file ingestion: A victim is tricked into importing or running a maliciously crafted .gguf model file.
2. Remote model registry interaction: Ollama's model management features can fetch models from remote registries or user-specified URLs. An attacker controlling a malicious model repository could serve a crafted GGUF file that is automatically parsed upon download or pull.

The NVD description notes the attack can be performed remotely, implying that the parser is reachable without direct filesystem access — for instance, via Ollama's API endpoints that trigger model loading or via a man-in-the-middle scenario during model pull operations.

Code-Level Insight: While the exact arithmetic operation is not detailed in the public description, integer overflows of this nature commonly occur when the length prefix is read as an unsigned 32-bit or 64-bit value, then implicitly converted to a signed integer, or when memory allocation size is calculated by adding a header size before the bounds check rather than after. The insufficient detail available means the precise trigger conditions require further vendor disclosure or analysis of the referenced patch.

Patch Analysis: The fix is identified by commit hash 67b6a1c2d45321e0cb3c04a18073f9818de7724b and is present in version 0.31.2-rc1. The absence of patch evidence from tracked sources (Patch Confidence: 0/4) suggests the patch may be in release candidate stage or dissemination is delayed; however, version 0.31.2-rc1 is explicitly named as remediating the issue.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the CVSS vector (UI:R requirement). No public PoC is available; the chain is theoretical but grounded in the described vulnerability mechanics.

1. Reconnaissance/Target Identification: An attacker identifies an exposed Ollama instance. Ollama's default API listens on port 11434. Attackers can use Shodan queries (e.g., port:"11434" or product:"Ollama") to discover internet-facing instances. Alternatively, the attacker targets a specific user or organization and identifies that they routinely load external GGUF model files or use Ollama's model-pulling functionality.

2. Triggering the Flaw: The attacker crafts a malicious GGUF v1 model file. In the version 1 structure, string metadata is serialized with a length prefix. The attacker sets this length prefix to a carefully chosen extreme value — for example, 0xFFFFFFFF (4,294,967,295) if the field is 32-bit, or a value that, when processed with an offset addition in readGGUFV1String, wraps the resulting index or allocation size around the integer boundary.

3. Payload/Delivery: The malicious model file is delivered via one of two methods:

   • User-Initiated (UI:R): The attacker sends the victim a link to a hosted malicious .gguf file or a malicious model registry. The victim, using the Ollama CLI (e.g., ollama pull) or the HTTP API, initiates the model load.
   • Direct API Interaction: If the Ollama API is exposed without authentication (a common misconfiguration), the attacker can directly POST a request to the model-upload or model-create endpoint with the crafted file.

   Because GGUF parsing is a local operation on the bytes of the file, the overflow is triggered during deserialization when the length field is processed.

4. Post-Exploitation Impact: The integer overflow likely results in an out-of-bounds read or write. Practical outcomes include:

   • Denial of Service: The process crashes with a runtime panic (Go's out-of-bounds access typically causes an unrecoverable panic), disrupting model-serving capabilities. This aligns with the CVSS Availability impact of Low.
   • Potential Memory Disclosure: If the overflow leads to an out-of-bounds read that does not crash, it could theoretically leak heap memory contents via error messages or subsequent parsing behavior. This remains speculative due to lack of code-level detail.

The requirement for UI:R (User Interaction) in the CVSS vector indicates that the standard exploitation path requires the victim to perform an action (e.g., clicking "pull" or "load"), which tempers the remote attack capability.

Impact Assessment

CVSS Analysis: The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L translates to:

• Attack Vector: Network — The vulnerable parser can be reached via network interfaces.
• Attack Complexity: Low — No special conditions beyond receiving the malicious file.
• Privileges Required: None — No authentication needed to trigger the vulnerable code path (other than the UI interaction).
• User Interaction: Required — The victim must load the malicious model.
• Scope: Unchanged — The compromise is contained to the affected component.
• Confidentiality: None | Integrity: None | Availability: Low — The primary confirmed impact is a degradation of service (crash/hang).

Business Impact: For organizations running Ollama as an internal service (e.g., for code completion, document analysis), the primary risk is service disruption. An attacker who can social-engineer an employee into loading a malicious model, or who can poison a model registry, could crash the server. In multi-tenant setups where one Ollama instance serves many users, this becomes a single-point-of-failure DoS vector.

Blast Radius: The affected component is the GGUF parser contained in the model-loading pipeline. The blast radius is somewhat limited because the overflow occurs during parsing before model weights are loaded into the inference engine. However, if the overflow corrupts heap metadata in the Go runtime, it could theoretically be leveraged for more impactful memory corruption, though no evidence of such escalation exists currently.

Affected Systems: All Ollama deployments running version ≤ 0.31.1, including Linux, macOS, and Windows server environments. Dockerized deployments are equally vulnerable if the container image is frozen at an affected version.

Detection Guidance

Detection of this vulnerability is challenging because the trigger is a binary file format flaw rather than a network signature. Detection must focus on anomalous file characteristics and crash patterns.

Sigma Rule

title: Potential GGUF Integer Overflow Exploitation - Ollama
id: 891c2f0f-2b19-43d5-9831-4d7d1b1e0a1c
status: experimental
description: Detects process crashes in Ollama related to the GGUF decoder, potentially indicating exploitation of CVE-2026-86289.
logsource:
  category: application
  product: ollama
detection:
  selection_crash:
    EventID: 0x1  # Go panic message pattern
    Image|endswith: '\ollama.exe'
    Details|contains:
      - 'panic: runtime error: index out of range'
      - 'panic: runtime error: slice bounds out of range'
      - 'readGGUFV1String'
  selection_file:
    EventID: 0x2  # File creation / import events
    TargetFilename|endswith: '.gguf'
    TargetFilename|contains: '\.ollama\models\\'
  condition: selection_crash and selection_file
level: high

YARA Rule

rule Ollama_CVE_2026_86289_GGUF_String_Overflow
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects maliciously crafted GGUF v1 files targeting the readGGUFV1String integer overflow in Ollama"
        cve = "CVE-2026-86289"
        date = "2026-11-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86289"

    strings:
        $gguf_magic = "GGUF" ascii
        $version_v1 = { 01 00 00 00 }  // GGUF version field = 1 (little-endian uint32)
        $sus_length_32 = { FF FF FF FF }  // Max uint32 length prefix
        $sus_length_64 = { FF FF FF FF FF FF FF FF }  // Max uint64 length prefix

    condition:
        uint32be(0) == 0x47475546 and  // 'GGUF' magic at offset 0
        $version_v1 at 4 and
        ( $sus_length_32 or $sus_length_64 )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-86289 - Potential GGUF Model Download with Crafted Size Header"; flow:to_server,established; content:"GET"; http_method; content:".gguf"; http_uri; pcre:"/^.{0,100}\xff\xff\xff\xff/"; classtype:attempted-dos; reference:cve,2026-86289; sid:20268629; rev:1;)

Elastic Detection

// EQL query for Elasticsearch
sequence by process.entity_id with maxspan=1m
  [ process where process.name == "ollama" and event.action == "exec"
      and process.args : ("*pull*", "*create*", "*import*") ]
  [ file where event.action == "write"
      and file.name : "*.gguf" and process.name == "ollama"
      and file.size >= 4200000000 ]

Splunk SPL Query

index=main sourcetype="ollama_logs"
  ( "panic: runtime error: index out of range" OR "panic: runtime error: slice bounds out of range" OR "readGGUFV1String" )
  | stats count by host, source, _time
  | where count > 1
  | sort - _time

Explanation: This query searches Ollama runtime logs for panic messages consistent with memory bounds violations. Excessive occurrence suggests a crash-loop pattern indicative of repeated malicious file parsing attempts.

Wazuh OSSEC Rule

<group name="ollama, cve-2026-86289,">
    <rule id="100862" level="10">
        <decoded_as>json</decoded_as>
        <field name="log">\.+panic: runtime error: index out of range\.+</field>
        <description>Ollama crash detected - possible GGUF integer overflow exploitation (CVE-2026-86289)</description>
        <mitre>
            <id>T1499</id>
        </mitre>
        <group>ollama_dos,</group>
    </rule>
    
    <rule id="100863" level="12">
        <if_sid>100862</if_sid>
        <match>readGGUFV1String</match>
        <description>Ollama GGUF decoder panic - potential CVE-2026-86289 exploitation attempt</description>
    </rule>
</group>

Mitigation & Patch Guidance

Current Patch Status: The vendor has identified a fix in commit 67b6a1c2d45321e0cb3c04a18073f9818de7724b and released version 0.31.2-rc1. However, the tracked Patch Confidence is 0/4, indicating that no third-party sources have confirmed or validated the patch's efficacy. Organizations should treat the vulnerable versions as unpatched until a stable release is confirmed and widely distributed.

Immediate Mitigations:

1. Restrict Inbound Access: If remote model pulling is not strictly required, block outbound network access from Ollama instances to untrusted registry servers. Use network-level firewall rules to restrict egress.
2. Authenticate API Access: Ensure the Ollama API is not exposed on 0.0.0.0:11434 without authentication. Bind to localhost or internal interfaces only, or use a reverse proxy with authentication.
3. Disable/Remove Auto-Pull Features: If using a management UI or scripts that automatically pull new models, disable these features until the stable patch is applied.
4. Vetting Process for Model Files: Establish a policy requiring that all GGUF files be sourced from the official Ollama library or internal, trusted mirrors. Scan any externally sourced models on an isolated system (no network access) before loading into production.

Patch/Upgrade Steps:

1. Monitor the Ollama GitHub releases page and the official repository for the stable release incorporating commit 67b6a1c2d45321e0cb3c04a18073f9818de7724b.
2. When available, upgrade to version 0.31.2 (stable) or later.
3. If operating via Docker, update the image to ollama/ollama:0.31.2 once available.
4. Verify installation: ollama --version should reflect the patched version.

Long-Term Hardening:

1. File Integrity Monitoring: Deploy FIM on model storage directories to alert on unexpected .gguf file additions or modifications.
2. Runtime Behavioral Monitoring: Use eBPF or system call monitoring to detect unusual memory access patterns or rapid, repeated process crashes in the ollama process, which could indicate probing.
3. Vulnerability Management Cadence: Subscribe to Ollama's security mailing list or monitor the GitHub Advisory Database for future parser-related CVEs, as binary format parsers are high-churn areas for bugs.
4. Least Privilege Execution: Run Ollama under a dedicated low-privilege service account to limit the impact of a potential memory corruption escalation.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-86289
2. Ollama Patch Commit: https://github.com/ollama/ollama/commit/67b6a1c2d45321e0cb3c04a18073f9818de7724b (as cited in NVD metadata)
3. Ollama Official Releases: https://github.com/ollama/ollama/releases — Monitor for version 0.31.2 stable.
4. NVD CWE-189 Reference: https://cwe.mitre.org/data/definitions/189.html — Integer overflow class description.
5. Ollama GGUF Specification (documentation): https://github.com/ggml-org/ggml — For context on the GGUF file format structure (note: this is format documentation, not a direct disclosure of the vulnerability).

Exploit-in-the-Wild Status: No evidence of active exploitation campaigns or exploits in the wild exists at the time of this report. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The exploit technique has been publicly disclosed (per NVD description: "The exploit has been made public"), which increases the risk of weaponization, but no functional code is confirmed to be circulating.