PT-2026-2320 · Ollama · Ollama

Bob14 + 1 · Published 2026-01-12 · Updated 2026-01-21 · CVE-2025-15514

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ollama versions 0.11.5-rc0 through 0.13.5

Description Ollama contains a flaw due to insufficient validation of base64-encoded image data. Specifically, when processing image data through the /api/chat endpoint, the application does not verify the validity of the decoded media before passing it to the mtmd helper bitmap init from buf function. If this function returns NULL, indicating malformed input, the code proceeds to dereference the NULL pointer, leading to a segmentation fault and a denial of service. This can cause the model to become unavailable until the service is restarted. The vulnerability exists in the multi-modal model image processing functionality.

Recommendations Update Ollama to a version newer than 0.13.5.

Exploit

Fix

DoS

Weakness Enumeration

CWE-395

Related Identifiers

CVE-2025-15514

Affected Products

Ollama

References · 8

• 🔥 https://huntr.com/bounties/172df98b-07cd-41ea-a628-366f8cd525c0 · Exploit
• https://osv.dev/vulnerability/CVE-2025-15514 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15514 · Security Note
• https://t.me/cveNotify/149424 · Telegram Post
• https://vulncheck.com/advisories/ollama-multi-modal-image-processing-null-pointer-dereference · Note
• https://ollama.com · Note
• https://https//github.com/ollama/ollama · Note
• https://twitter.com/CVEnew/status/2010859147756220580 · Twitter Post