PT-2026-3790 · Ollama · Ollama

Published 2026-01-21 · Updated 2026-02-08 · CVE-2025-66960

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Ollama versions prior to 0.12.10

Description An issue exists in the readGGUFV1String() function within the Ollama large language model (LLM) launch and management system. Insufficient input validation in this function can allow a remote attacker to cause a denial of service. The issue resides in the fs/ggml/gguf.go file, where the readGGUFV1String() function reads a string length from untrusted GGUF metadata.

Recommendations Update to version 0.12.10 or later.

Exploit

Fix

DoS

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

BDU:2026-00974

CVE-2025-66960

PYSEC-2026-102

Affected Products

Ollama

References · 8

• 🔥 https://zero.shotlearni.ng/blog/cve-2025-66960guf-v1-string-length-cause-panic-in-readggufv1string · Exploit
• https://github.com/ollama/ollama/issues/9820 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66960 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66960 · Security Note
• https://bdu.fstec.ru/vul/2026-00974 · Security Note
• https://twitter.com/desckimh/status/2020561454731035057 · Twitter Post
• https://t.me/CVEtracker/42678 · Telegram Post