CVE-2026-86289: Ollama GGUF Decoder RCE Vulnerability

CVE-2026-86289 Overview

CVE-2026-86289 is an integer overflow vulnerability in Ollama, the open-source large language model runtime. The flaw resides in the readGGUFV1String function within fs/ggml/gguf.go, part of the GGUF Decoder component. Attackers can trigger the overflow remotely by supplying a crafted GGUF model file, though user interaction is required to load the file. The issue affects Ollama versions up to and including 0.31.1 and is addressed in 0.31.2-rc1. Public exploit details are available, and the patch is tracked under commit 67b6a1c2d45321e0cb3c04a18073f9818de7724b.

Critical Impact

Remote attackers can trigger integer overflow conditions in the GGUF Decoder by supplying malicious model files, potentially leading to memory corruption or process instability.

Affected Products

• Ollama versions up to 0.31.1
• Ollama GGUF Decoder component (fs/ggml/gguf.go)
• readGGUFV1String function in the GGUF parsing pipeline

Discovery Timeline

• 2026-09-07 - CVE-2026-86289 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86289

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-189] in the GGUF (GGML Universal File) parser used by Ollama to load model files. When readGGUFV1String processes length fields from an untrusted GGUF file, arithmetic on unbounded size values wraps around the native integer range. This wrap-around bypasses subsequent length checks and produces incorrect allocation or copy sizes downstream in the decoder. The remote attack surface exists because Ollama servers frequently ingest model files supplied over the network or pulled from external registries.

Root Cause

The root cause is missing overflow validation when computing tensor and string sizes derived from attacker-controlled fields in the GGUF header. The parser multiplies shape dimensions and length values without checking whether the product exceeds uint64 boundaries. It also lacks upper bounds on string and array sizes, allowing pathological values to reach memory allocation paths.

Attack Vector

An attacker crafts a malicious GGUF model file containing header fields that force an overflow during string or tensor size computation. When a user or automated pipeline loads the file into Ollama, the decoder performs the unsafe arithmetic, producing a truncated size used for allocation. Exploitation requires user interaction to trigger model loading but does not require authentication.

// Patch from fs/ggml/ggml.go — safe multiplication for tensor element count
func (t Tensor) elements() (uint64, bool) {
    var count uint64 = 1
    for _, n := range t.Shape {
        if n != 0 && count > ^uint64(0)/n {
            return 0, false
        }
        count *= n
    }
    return count, true
}

func (t Tensor) size() (uint64, bool) {
    elements, ok := t.elements()
    if !ok {
        return 0, false
    }

    typeSize := t.typeSize()
    blockSize := t.blockSize()
    if typeSize == 0 || blockSize == 0 {
        return 0, false
    }
}

Source: GitHub Commit 67b6a1c2

The patch also introduces explicit upper bounds in fs/gguf/gguf.go:

const (
    MaxStringLength = 16 << 20
    MaxArraySize    = 64 << 20

    MaxTensorDims = 4
)

Source: GitHub Commit 67b6a1c2

Detection Methods for CVE-2026-86289

Indicators of Compromise

• Ollama process crashes or abnormal memory growth immediately after loading a GGUF model file
• GGUF files containing header string or array length fields near uint64 boundary values
• Model artifacts pulled from untrusted registries or shared paths outside the organization's approved catalog

Detection Strategies

• Inventory hosts running Ollama versions at or below 0.31.1 using package or binary version checks
• Inspect GGUF file headers for oversized string lengths or tensor dimensions that exceed the new limits (MaxStringLength, MaxArraySize, MaxTensorDims)
• Alert on Ollama service exits with signal codes consistent with memory corruption after model load events

Monitoring Recommendations

• Log all model load operations, including source URI, file hash, and requesting user or service account
• Track network egress from Ollama hosts to third-party model registries and flag unapproved sources
• Correlate Ollama crash telemetry with recent model imports to identify potentially malicious files

How to Mitigate CVE-2026-86289

Immediate Actions Required

• Upgrade Ollama to 0.31.2-rc1 or later to receive the hardened GGUF parser
• Restrict Ollama endpoints so that only authenticated internal clients can submit or trigger model loads
• Audit existing GGUF files against the new size limits and quarantine any that exceed them

Patch Information

The fix is delivered in Ollama release v0.31.2-rc1 via commit 67b6a1c2d45321e0cb3c04a18073f9818de7724b, tracked in Pull Request #17062 and Issue #17033. The patch introduces overflow-safe multiplication for tensor element counts and enforces MaxStringLength, MaxArraySize, and MaxTensorDims bounds during GGUF decoding.

Workarounds

• Load only GGUF models from trusted, integrity-verified sources such as signed internal registries
• Run Ollama inside a sandboxed container with strict memory limits to contain any decoder crashes
• Disable network-exposed model import endpoints until the upgrade to 0.31.2-rc1 or newer is complete

# Verify installed Ollama version and upgrade
ollama --version

# Pull the patched release
git clone https://github.com/ollama/ollama.git
cd ollama
git checkout v0.31.2-rc1
go build ./...