Ollama GGUF Decoder gguf.go readGGUFV1String integer overflow
cve-program · CVE-2026-86289
PublishedA vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.31.2-rc1 is capable of addressing this issue. The patch is named 67b6a1c2d45321e0cb3c04a18073f9818de7724b. It is recommended to upgrade the affected component.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-86289 · CVE overview and exploitation status
cve-program · CVE-2026-86289
- https://vuldb.com/vuln/399448
- https://vuldb.com/vuln/399448/cti
- https://vuldb.com/cve/CVE-2026-86289
- https://vuldb.com/submit/906136
- https://github.com/ollama/ollama/issues/17033
- https://github.com/ollama/ollama/pull/17062
- https://github.com/ollama/ollama/commit/67b6a1c2d45321e0cb3c04a18073f9818de7724b
- https://github.com/ollama/ollama/releases/tag/v0.31.2-rc1
- https://github.com/ollama/ollama/
Related changes
Linked by CVE identifierNo related changes are available here.