Bleeding Llama: Critical Ollama Flaw Leaks AI Server Memory to Unauthenticated Attackers

Security researchers have disclosed a critical vulnerability in Ollama, one of the most widely deployed open-source frameworks for running large language models locally, that allows a remote, unauthenticated attacker to extract the server's entire process memory. The flaw, tracked as CVE-2026-7482 with a CVSS score of 9.1, has been codenamed Bleeding Llama by researchers at Cyera and is estimated to affect more than 300,000 servers globally.

Ollama has become a default tool of choice for organisations deploying AI inference workloads without cloud dependencies. With more than 171,000 stars on GitHub and over 16,100 forks, it sits at the centre of a growing number of enterprise AI pipelines across the GCC and beyond.

What the Vulnerability Does

The flaw originates in Ollama's GGUF model loader, specifically in a function named WriteTo(), which uses Go's unsafe package to handle operations that bypass the memory safety guarantees the language is built around.

An attacker can exploit the flaw in three steps. First, they upload a specially crafted GGUF file with an inflated tensor shape value to a network-accessible Ollama instance via a standard HTTP POST request. Second, they trigger model creation through the /api/create endpoint, firing the out-of-bounds heap read. Third, they exfiltrate the resulting memory dump to an external server using the /api/push endpoint.

What can be extracted is significant: API keys, proprietary source code, customer contracts, system prompts, and the conversation data of concurrent users. In deployments where Ollama is connected to agentic tools, all tool outputs flow through the server, are stored in the heap, and become available to the attacker.

The patch is available in Ollama version 0.17.1 and above. Organisations running earlier versions should update immediately.

Two Separate Unpatched Flaws on Windows

Separate research from Striga has identified two additional vulnerabilities in Ollama's Windows update mechanism that remain unpatched. Both were disclosed on 27 January 2026 and published following the expiry of a 90-day disclosure window.

CVE-2026-42249 (CVSS 7.7) is a path traversal flaw; the Windows updater creates a staging directory path directly from HTTP response headers without sanitising the input. CVE-2026-42248 (CVSS 7.7) is a missing signature verification flaw; unlike the macOS version, the Windows desktop client does not verify update binaries before installation.

When combined, both flaws allow an attacker who controls an update server reachable by the victim's Ollama client to deliver an arbitrary executable, write it to the Windows Startup folder, and achieve persistent code execution at every login. Realistic payloads include reverse shells, information stealers, and droppers establishing additional persistence. Affected versions span Ollama for Windows 0.12.10 through 0.22.0.

Implications for GCC Enterprises

The disclosure is particularly relevant for organisations across the GCC that have deployed Ollama as part of internal AI inference pipelines. The framework's lack of built-in authentication means that any instance exposed to a network is a viable attack surface if proper controls are not in place.

Security teams should audit running instances for internet exposure, isolate deployments behind a firewall or authentication proxy, and review access controls on any environment where Ollama connects to external tools or data sources. For Windows deployments, automatic updates should be disabled until patches for CVE-2026-42248 and CVE-2026-42249 are available.

The combination of a critical memory-leak vulnerability and two persistent code-execution flaws across the same framework represents a significant risk for any enterprise that has adopted Ollama without applying the same security rigour as other production services.