CVE Feed

    Dashboard / CVE / CVE-2026-86289

    CVE-2026-86289

    A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.31.2-rc1 is capable of addressing this issue. The patch is named 67b6a1c2d45321e0cb3c04a18073f9818de7724b. It is recommended to upgrade the affected component.

    Published:Sep 7, 2026
    Last Modified:Sep 7, 2026
    EPS:Sep 7, 2026
    EPSS Score:
    CVSS Score:4.3

    Affected Products

    Vendor
    Ollama
    Product
    Ollama

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-190 Integer Overflow or Wraparound

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-85180 (CVSS 8.7) — Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated atta…
    CVE-2026-65315 (CVSS 8.7) — Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser tha…
    CVE-2026-15685 (CVSS 7.5) — Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability all…
    CVE-2026-5757 (CVSS 7.5) — Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an at…
    CVE-2026-7482 (CVSS 8.8) — Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/creat…
    CVE-2026-42249 (CVSS 7.7) — Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper hand…
    CVE-2026-42248 (CVSS 7.7) — Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. U…
    CVE-2026-7020 (CVSS 2.9) — A security flaw has been discovered in Ollama up to 0.20.2. This affects the function digestToPath of the file…
    CVE-2026-5530 (CVSS 5.3) — A flaw has been found in Ollama up to 0.18.1. This issue affects some unknown processing of the file server/do…
    CVE-2025-66960 (CVSS 7.5) — An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, fu…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High