Critical Flaws in Ollama: Memory Leaks, Persistent RCE, and What Every AI Operator Needs to Know

Ollama has rapidly established itself as the de facto standard for local large language model (LLM) deployment. With over 171,000 GitHub stars and a thriving open-source community, it offers developers a frictionless way to run, fine-tune, and serve AI models without relying on third-party cloud APIs. But beneath its streamlined interface and developer-friendly design lies a concerning security reality: the very mechanisms that make Ollama easy to use are also creating attack surfaces that threat actors can exploit with minimal friction.

Recent disclosures have brought two distinct, high-impact vulnerabilities to light. The first, a critical out-of-bounds memory read codenamed Bleeding Llama, threatens hundreds of thousands of publicly exposed Ollama servers. The second, a pair of unpatched flaws in the Windows desktop client, enables persistent remote code execution through the application’s auto-update mechanism. Together, these findings underscore a pressing truth: as AI infrastructure moves into production, traditional application security practices must evolve to match the unique risks of model-serving frameworks.

Bleeding Llama: A Heap Read That Exposes the Entire AI Stack

Tracked as CVE-2026-7482 (CVSS 9.1), Bleeding Llama is a heap out-of-bounds read vulnerability residing in Ollama’s GGUF model loader. To understand its severity, we first need to look at how Ollama handles model files. GGUF (GPT-Generated Unified Format) is the standardized container format for quantized LLM weights, metadata, and tensor shapes. When a user or automated system uploads a GGUF file to an Ollama instance via the /api/create endpoint, the framework parses the file’s metadata to allocate heap memory and map tensor data.

The flaw emerges during this parsing phase. If an attacker supplies a maliciously crafted GGUF file where the declared tensor offset and size exceed the actual file length, Ollama’s quantization routine—specifically the WriteTo() function in fs/ggml/gguf.go and server/quantization.go—proceeds to read past the bounds of the allocated heap buffer.

The root cause traces back to Ollama’s use of Go’s unsafe package, which intentionally bypasses the language’s built-in memory safety guarantees to optimize low-level binary operations. While this trade-off is common in systems programming for performance, it shifts the burden of bounds-checking entirely onto the developer.

In a practical exploitation scenario, a remote attacker sends a specially constructed GGUF payload to an exposed Ollama server. By manipulating the tensor shape metadata, the attacker triggers an out-of-bounds read that spills sensitive heap contents back to the client.

What ends up in that leaked memory? Almost everything the Ollama process touches: environment variables, cloud API keys, system prompts, concurrent user conversation history, and internal routing configurations. Once the data is extracted, the attacker can package it into a model artifact and exfiltrate it using Ollama’s /api/push endpoint, which forwards the payload to a registry under the attacker’s control.

The impact extends beyond simple data leakage. As Cyera security researcher Dor Attias noted, the inference process itself becomes a data sink. When engineers chain Ollama to development tools like Claude Code, every tool output, debug trace, and prompt injection attempt flows into the Ollama heap. A successful Bleeding Llama exploit doesn’t just steal secrets; it reconstructs an organization’s entire AI workflow.

Remediation: This vulnerability was patched in Ollama v0.17.1. All production instances must be updated immediately. Additionally, because Ollama’s REST API ships without built-in authentication, operators should place a reverse proxy (such as Nginx, Traefik, or Cloudflare Access) in front of the service, enforce strict network segmentation, and audit DNS records to ensure no instances are inadvertently exposed to the public internet.

Windows Auto-Update Chain: Persistent Code Execution Without a Signature

While Bleeding Llama targets server-side deployments, a separate threat landscape exists for Windows users. Researchers at Striga have documented two interrelated vulnerabilities in Ollama’s Windows desktop client that, when chained, yield persistent remote code execution at the user privilege level. These flaws, CVE-2026-42248 and CVE-2026-42249 (both CVSS 7.7), remain unpatched as of the January 2026 disclosure window.

The attack surface revolves around Ollama’s auto-update mechanism. By default, the Windows client launches on user login from the %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup directory. Once running, it silently polls the /api/update endpoint to check for new versions. If an update is available, the client downloads the binary and stages it for installation on the next launch.

The first flaw, CVE-2026-42248, is a missing signature verification step. Unlike the macOS variant, which cryptographically validates update payloads before execution, the Windows updater installs the binary without verifying its authenticity or integrity.

The second flaw, CVE-2026-42249, is a path traversal vulnerability. The Windows installer constructs its staging directory path directly from HTTP response headers without sanitizing directory separators, allowing an attacker to redirect the downloaded file to arbitrary locations on the filesystem.

When chained, these flaws create a highly reliable persistence mechanism. An attacker who controls or compromises the update server (or manipulates the OLLAMA_UPDATE_URL environment variable to point to a malicious HTTP endpoint) can serve a payload that bypasses signature checks and writes directly into the Windows Startup folder.

On the next system login, Windows executes the attacker’s binary as the current user. The execution is persistent because the post-write cleanup routine that normally removes unsigned files is effectively a no-op on Windows.

Even without chaining, CVE-2026-42248 alone enables non-persistent code execution: the malicious binary is dropped into the expected staging directory, and the next Ollama launch triggers it before the updater can re-verify signatures. By adding the path traversal, attackers achieve true persistence, with realistic payloads ranging from reverse shells and browser credential stealers to droppers that establish additional footholds.

Remediation: These flaws affect Ollama for Windows versions 0.12.10 through 0.22.0. Until a patch is released, administrators should:

• Disable automatic updates by setting AutoUpdateEnabled=false in the configuration file.
• Remove the Ollama shortcut from the Windows Startup folder to break the silent on-login execution pathway.
• Monitor outbound HTTP requests from the Ollama process to detect unauthorized OLLAMA_UPDATE_URL overrides.
• Restrict Windows client network access to trusted internal endpoints where possible.

Securing the AI Stack: Lessons from the Ollama Disclosures

These vulnerabilities highlight a broader industry challenge: AI inference frameworks are often built with developer velocity in mind, not enterprise-grade security. Ollama’s lack of native authentication, reliance on unsafe memory operations, and trust-based update pipelines are not unique oversights; they reflect a pattern where open-source AI tools are deployed in production environments before security hardening is complete.

For organizations running Ollama in production, the path forward requires a defense-in-depth approach:

• Enforce authentication at the network layer: Since Ollama does not implement auth natively, deploy an API gateway or reverse proxy with JWT, OAuth2, or mTLS validation.
• Isolate inference workloads: Run Ollama in containerized or sandboxed environments with strict resource limits, disabled network egress where possible, and dedicated service accounts.
• Validate all model inputs: Implement strict GGUF schema validation before passing files to the loader. Reject payloads with mismatched tensor offsets, excessive sizes, or malformed headers.
• Monitor heap and memory anomalies: Deploy runtime application self-protection (RASP) or eBPF-based memory monitoring to detect out-of-bounds reads and unexpected heap allocations.
• Manage third-party integrations carefully: Treat tool chains (like Claude Code, LangChain, or custom agents) as extended attack surfaces. Log all prompt inputs, system messages, and tool outputs to detect exfiltration attempts.

The human element cannot be overlooked either. AI infrastructure is increasingly handling proprietary code, customer contracts, and internal research data. A memory leak or persistent RCE doesn’t just compromise a service; it compromises trust. Security teams must treat LLM deployment pipelines with the same rigor as traditional backend systems, applying patch management, network segmentation, and continuous monitoring as baseline requirements.

Final Thoughts

Ollama’s rise has democratized local AI, but it has also accelerated the deployment of unhardened infrastructure at scale. Bleeding Llama and the Windows auto-update chain are not isolated bugs; they are symptoms of a growing pains phase in AI engineering. By understanding the technical mechanics behind these flaws, enforcing strict network controls, and adopting a zero-trust posture around model inputs and updates, organizations can safely harness the power of local LLMs without exposing their data, their systems, or their users to unnecessary risk.

The window to remediate is open. Update to v0.17.1+, lock down your endpoints, disable unverified auto-updates on Windows, and treat every GGUF file and API call as untrusted until proven otherwise. In the rapidly maturing landscape of AI security, vigilance isn’t optional—it’s the foundation.