PT-2026-2320 · Ollama · Ollama

Bob14 + 1 · Publicado 2026-01-12 · Atualizado 2026-01-21 · CVE-2025-15514

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ollama versions 0.11.5-rc0 through 0.13.5

Description Ollama contains a flaw due to insufficient validation of base64-encoded image data. Specifically, when processing image data through the /api/chat endpoint, the application does not verify the validity of the decoded media before passing it to the mtmd helper bitmap init from buf function. If this function returns NULL, indicating malformed input, the code proceeds to dereference the NULL pointer, leading to a segmentation fault and a denial of service. This can cause the model to become unavailable until the service is restarted. The vulnerability exists in the multi-modal model image processing functionality.

Recommendations Update Ollama to a version newer than 0.13.5.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-395

Identificadores relacionados

CVE-2025-15514

Produtos afetados

Ollama

Referências · 8

• 🔥 https://huntr.com/bounties/172df98b-07cd-41ea-a628-366f8cd525c0 · Exploit
• https://t.me/cveNotify/149424 · Publicação no Telegram
• https://vulncheck.com/advisories/ollama-multi-modal-image-processing-null-pointer-dereference · Nota
• https://ollama.com · Nota
• https://osv.dev/vulnerability/CVE-2025-15514 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-15514 · Nota de Segurança
• https://https//github.com/ollama/ollama · Nota
• https://twitter.com/CVEnew/status/2010859147756220580 · Publicação no Twitter