Bleeding Llama: How a Heap Overflow in Ollama Leaks AI Model Memory to Anyone

TL;DR

Cyera Research disclosed CVE-2026-7482 ("Bleeding Llama"), a critical unauthenticated memory leak in Ollama, the popular framework for running large language models locally. An attacker can extract API keys, proprietary code, system prompts, and user chat fragments from any internet-exposed Ollama server with just three API calls. Ollama patched the flaw in version 0.17.1, but an estimated 300,000 vulnerable instances remain online.

What Happened

On May 5, 2026, Cyera Research published a detailed vulnerability disclosure for CVE-2026-7482, dubbed "Bleeding Llama"—a critical heap out-of-bounds read vulnerability in Ollama's model quantization pipeline. The bug scores 9.1 on the CVSS v3.1 scale (Echo's CNA raises it to 9.3) and requires no authentication, no user interaction, and no special privileges to exploit.

The vulnerability lives in how Ollama processes GGUF (GPT-Generated Unified Format) model files. When a user uploads or creates a model, Ollama's quantization engine converts tensors between precision formats (e.g., float-16 to float-32). During this conversion, Ollama trusts the tensor dimensions declared in the GGUF file without validating them against the actual buffer size allocated in memory. An attacker who crafts a GGUF that declares a tensor far larger than the file actually contains forces Ollama to read hundreds of kilobytes—or more—of adjacent heap memory.

Because the F16→F32 conversion is mathematically lossless, every stolen byte is preserved perfectly in the resulting model weights. The attacker then calls Ollama's /api/push endpoint to upload the data-poisoned model to a server they control, exfiltrating the leaked memory silently.

Disclosure Timeline:

• February 2, 2026: Cyera reported the flaw to Ollama.
• February 25, 2026: Ollama shared a fix.
• Version 0.17.1: Released with the patch (but not flagged as a security update in release notes).
• March 2, 2026: Cyera requested a CVE from MITRE; request went unanswered.
• April 28, 2026: Echo CNA assigned CVE-2026-7482.
• May 1–5, 2026: CVE published; Cyera research disclosed details.

The three-month lag between patch and public CVE is critical: without a CVE number, vulnerability scanners remained blind to the issue, and many operators never realized they should upgrade.

Technical Details

The Three-Call Exploit Chain

The full attack requires no authentication:

1. POST /api/blobs/sha256: Upload a malicious GGUF blob with oversized tensor declarations.

2. POST /api/create: Create a model from the blob and trigger quantization conversion. Ollama reads past the allocated buffer and bakes the leaked heap data into the model weights.

3. POST /api/push: Push the poisoned model to an attacker-controlled registry (e.g., registry.attacker.com/stolen-model), exfiltrating the embedded heap data.

Why It Works

• Unsafe Memory Operations: Ollama uses Go's unsafe package for low-level memory operations in the conversion pipeline, bypassing Go's normal safety boundaries.
• No Bounds Checking: The code trusts GGUF tensor metadata without verifying it against the file's actual size.
• Lossless Conversion Path: By using F16→F32 quantization, the attacker avoids lossy compression that would corrupt the stolen data.
• Silent Failure: Ollama logs no errors and does not crash, making detection difficult without dedicated endpoint monitoring.

What an Attacker Can Steal

Whatever happens to live on Ollama's heap becomes extractable:

• User prompts and chat histories from concurrent inference sessions
• System prompts and instructions embedded in models
• Environment variables (API keys for OpenAI, Anthropic, database credentials, cloud secrets)
• Code snippets being processed by inference jobs
• PII and PHI flowing through model pipelines
• Proprietary business logic hardcoded into prompts or model metadata

In an enterprise AI stack, this is the keys to the kingdom: a single compromised Ollama instance can leak credentials, internal instructions, customer data, and IP in a single attack.

Lyrie Assessment

Why This Matters for Autonomous Defense:

1. The Supply Chain Problem: Ollama is deployed across research labs, startups, and enterprises as a "lightweight local LLM runtime." Its defaults—no authentication, binds to 0.0.0.0—were designed for development, not defense. As AI workloads move into production, these assumptions break catastrophically.

2. The Detection Gap: The exploit leaves minimal forensic trace:

- No authentication logs (API is unauthenticated).

- No process crashes or errors.

- The poisoned model looks legitimate on disk.

- Without monitoring /api/create and /api/push calls, the breach goes undetected.

3. The Autonomous Angle: Lyrie's autonomous defense systems should:

- Detect unauthenticated API endpoints on internal networks—especially those handling sensitive data (models, prompts, credentials).

- Monitor for unusual quantization/conversion operations—especially those pushing models to external registries.

- Trap heap memory access patterns typical of buffer-over-reads during tensor processing.

- Flag GGUF files with inconsistent metadata (declared size >> actual size) as potential attack vectors.

4. The Vendor Problem: Ollama's patch was released 79 days before a CVE was assigned. Many operators—scanning for CVE numbers, not firmware versions—never knew they had a critical flaw. This is a systemic disclosure failure that autonomous threat intelligence must compensate for.

Recommended Actions

Immediate (Today)

• Scan your network for internet-exposed Ollama instances (default port 11434, /api/tags endpoint is public).

  nmap -p 11434 <network> | grep open

• Upgrade to Ollama 0.17.1 or later immediately on all instances.
• Treat any pre-0.17.1 instance as compromised:

- Rotate all API keys (OpenAI, Anthropic, database, cloud).

- Invalidate any OAuth or bearer tokens stored in environment variables.

- Audit logs for external model push operations.

Short-Term (This Week)

• Isolate Ollama from the public internet. Bind it to 127.0.0.1 or restrict access via firewall rules.
• Add authentication in front: Deploy a reverse proxy (Cloudflare Access, OAuth proxy, Tailscale) to require credentials before any API call.
• Monitor the sensitive endpoints:

- /api/create (model creation + quantization triggers).

- /api/push (exfiltration to external registries).

- /api/blobs/sha256 (malicious file uploads).

Long-Term

• Enable memory isolation tools for Ollama processes (e.g., seccomp, AppArmor, or process sandboxing).
• Implement prompt injection detection on all user-supplied input flowing to models.
• Deploy autonomous threat hunts for evidence of heap memory exfiltration or unusual quantization activity.

Sources

1. Bleeding Llama: Critical Unauthenticated Memory Leak in Ollama — Cyera Research

2. Bleeding Llama: Critical Unauthenticated Memory Leak Hits 300,000 Ollama Servers — RITS Shanghai

3. Critical Ollama Memory Leak Vulnerability Exposes 300,000 Servers Globally — CyberSecurityNews

4. CVE-2026-7482 — Vulnerability-Lookup (CIRCL)

---

Lyrie.ai Cyber Research Division