CVE-2026-86289: Ollama integer overflow

CISO Take

A publicly disclosed vulnerability in Ollama's GGUF model decoder (readGGUFV1String, fs/ggml/gguf.go) allows a malformed model file to trigger an integer overflow, crashing the inference service. The flaw is remotely reachable and requires no privileges, but it does need user interaction — someone has to pull, download, or load the crafted GGUF file — and the CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/C:N/I:N/A:L) reflects a low-severity availability hit rather than data compromise or code execution. There's no EPSS score and it isn't in CISA KEV, so there's no evidence of active exploitation, but a public exploit does exist and Ollama is one of the most widely deployed local LLM inference runtimes, making it an attractive target for anyone distributing tampered models. Any team running Ollama for local or self-hosted inference should upgrade to 0.31.2-rc1 (or later stable release once cut) and, in the interim, restrict model sources to trusted registries and avoid loading GGUF files from unverified third parties. Monitor Ollama service logs for unexpected crashes or restarts correlated with model-load events as a detection signal.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Low-to-medium risk in isolation: CVSS 4.3 with availability-only impact (no confidentiality or integrity loss), no KEV listing, and no EPSS data suggesting active mass exploitation. However, the requirement for user interaction maps closely to how Ollama is actually used — pulling models from registries or loading files shared informally — which is a normal daily workflow for AI engineers, raising the realistic likelihood of accidental or social-engineered triggering above what the raw CVSS score implies. The public availability of an exploit lowers the barrier for opportunistic abuse, even though the worst outcome documented is a service crash, not compromise.

How does the attack unfold?

Artifact Crafting & Delivery

Attacker crafts a malicious GGUF model file with a manipulated string field designed to trigger an integer overflow and distributes it via a model registry, forum, or direct link.

AML.T0011.000

User Execution

A victim pulls, downloads, or loads the malicious GGUF file into their local Ollama instance, believing it to be a legitimate model.

AML.T0011

Exploitation

Ollama's readGGUFV1String function parses the crafted field, triggering an integer overflow (CWE-190/CWE-189) in the GGUF decoder.

Impact

The overflow crashes the Ollama process, causing a denial of service for any application or pipeline depending on that inference instance.

Artifact Crafting & Delivery

Attacker crafts a malicious GGUF model file with a manipulated string field designed to trigger an integer overflow and distributes it via a model registry, forum, or direct link.

AML.T0011.000

User Execution

A victim pulls, downloads, or loads the malicious GGUF file into their local Ollama instance, believing it to be a legitimate model.

AML.T0011

Exploitation

Ollama's readGGUFV1String function parses the crafted field, triggering an integer overflow (CWE-190/CWE-189) in the GGUF decoder.

Impact

The overflow crashes the Ollama process, causing a denial of service for any application or pipeline depending on that inference instance.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ollama	pip	—	No patch
180.8K 1.8K dependents Pushed 8d ago 15% patched ~36d to patch Full package profile →

Do you use Ollama? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C None

I None

A Low

What should I do?

1 step

Upgrade Ollama to 0.31.2-rc1 or later, which contains the fix (commit 67b6a1c2d45321e0cb3c04a18073f9818de7724b). Until upgraded, only load GGUF models from trusted, verified sources (official model registries, internally vetted repositories) and avoid opening GGUF files received via untrusted channels. Where feasible, run Ollama inference workloads in isolated/sandboxed environments or containers with automatic restart so a crash doesn't cause extended downtime, and add monitoring/alerting on unexpected Ollama process restarts to detect exploitation attempts. Track the upstream GitHub issue (#17033) and PR (#17062) for confirmation of the final stable release beyond the -rc1 tag.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Supply Chain Inference Model AML.T0010.003 - Model AML.T0011 - User Execution AML.T0011.000 - Unsafe AI Artifacts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.10.2 - Third-party and customer relationships

NIST AI RMF

GOVERN 6.1 - Policies and procedures for third-party AI system and component risks

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-86289?

A publicly disclosed vulnerability in Ollama's GGUF model decoder (readGGUFV1String, fs/ggml/gguf.go) allows a malformed model file to trigger an integer overflow, crashing the inference service. The flaw is remotely reachable and requires no privileges, but it does need user interaction — someone has to pull, download, or load the crafted GGUF file — and the CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/C:N/I:N/A:L) reflects a low-severity availability hit rather than data compromise or code execution. There's no EPSS score and it isn't in CISA KEV, so there's no evidence of active exploitation, but a public exploit does exist and Ollama is one of the most widely deployed local LLM inference runtimes, making it an attractive target for anyone distributing tampered models. Any team running Ollama for local or self-hosted inference should upgrade to 0.31.2-rc1 (or later stable release once cut) and, in the interim, restrict model sources to trusted registries and avoid loading GGUF files from unverified third parties. Monitor Ollama service logs for unexpected crashes or restarts correlated with model-load events as a detection signal.

Is CVE-2026-86289 actively exploited?

No confirmed active exploitation of CVE-2026-86289 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86289?

Upgrade Ollama to 0.31.2-rc1 or later, which contains the fix (commit 67b6a1c2d45321e0cb3c04a18073f9818de7724b). Until upgraded, only load GGUF models from trusted, verified sources (official model registries, internally vetted repositories) and avoid opening GGUF files received via untrusted channels. Where feasible, run Ollama inference workloads in isolated/sandboxed environments or containers with automatic restart so a crash doesn't cause extended downtime, and add monitoring/alerting on unexpected Ollama process restarts to detect exploitation attempts. Track the upstream GitHub issue (#17033) and PR (#17062) for confirmation of the final stable release beyond the -rc1 tag.

What systems are affected by CVE-2026-86289?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference, local AI deployments.

What is the CVSS score for CVE-2026-86289?

CVE-2026-86289 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inferencelocal AI deployments

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011 User Execution

AML.T0011.000 Unsafe AI Artifacts

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.2

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.31.2-rc1 is capable of addressing this issue. The patch is named 67b6a1c2d45321e0cb3c04a18073f9818de7724b. It is recommended to upgrade the affected component.

Exploitation Scenario

An adversary crafts a malicious GGUF model file with a manipulated string-length field designed to trigger an integer overflow in the readGGUFV1String parsing routine, then publishes it on a community model-sharing site, forum, or sends it directly to a target (e.g., 'try this fine-tuned model'). A developer or AI engineer pulls or loads the file into their local Ollama instance to test it. When Ollama parses the GGUF header, the overflow corrupts internal state and crashes the process, disrupting any application, agent, or pipeline currently depending on that Ollama instance for inference — a low-effort way to disrupt an AI-dependent workflow or as a nuisance/DoS vector against a targeted developer or team.

Weaknesses (CWE)

CWE-189 Primary CWE-190 Integer Overflow or Wraparound Primary CWE-189 CWE-190 Integer Overflow or Wraparound

CWE-190 — Integer Overflow or Wraparound: The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

[Requirements] Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. If possible, choose a language or compiler that performs automatic bounds checking.

Source: MITRE CWE corpus.