AIDEFEND SecureFlow / SecureFlow Case Index

Bleeding Llama: Ollama GGUF Heap Read and Model Push

• Autonomous Agents
• Data Exfiltration

Cyera demonstrated that a crafted GGUF tensor size could make Ollama before 0.17.1 read beyond its heap buffer during F16-to-F32 conversion in /api/create; the flaw is tracked as CVE-2026-7482, a public vulnerability identifier. The leaked bytes were written into a model artifact and could be sent to an attacker registry through /api/push. Network exploitation requires an exposed API: the upstream Ollama binary defaults to 127.0.0.1, the official container image sets OLLAMA_HOST to 0.0.0.0, and operators can change the bind address themselves.