CVE-2025-15514
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Ollama versions 0.11.5-rc0 through 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid media before passing it to the mtmd_helper_bitmap_init_from_buf function. This function can return NULL for malformed input, but the code does not check this return value before dereferencing the pointer in subsequent operations.
Risk Assessment
A remote attacker can exploit this by sending specially crafted base64 image data that decodes to invalid media, causing a segmentation fault and crashing the runner process. This results in a denial of service (DoS) condition where the model becomes unavailable to all users until the service is restarted.
Recommendation
It is recommended to immediately update Ollama to a version later than 0.13.5 that contains the fix for this vulnerability. If an update is not possible, restrict access to the /api/chat endpoint to trusted users only.
Other vulnerabilities in Ollama
See all- CVE-2025-63389Critical
Critical authentication bypass vulnerability in Ollama platform's API endpoints up to v0.12.3. Multiple API endpoints are exposed without authentication, allowing remote attackers to perform unauthorized model management operations.
- CVE-2026-65315High
Ollama (HEAD f0078ae) has an uncontrolled memory allocation vulnerability in the GGUF metadata parser. A remote attacker can upload a crafted sub-1KB GGUF file via the blob upload and model create/pull APIs, triggering an unrecoverable Go runtime out-of-memory fatal error or makeslice panic that bypasses recovery middleware and crashes the entire server.
- CVE-2026-15685High
A vulnerability in the downloadBlob function in Ollama allows a remote attacker to cause a denial-of-service (DoS) condition without authentication. The issue stems from improper validation of user-supplied data, leading to an out-of-bounds memory access.
- CVE-2026-5757High
An unauthenticated remote attacker can read and exfiltrate the heap memory of the Ollama server through the model quantization engine, leading to sensitive data exposure.
- CVE-2026-5530Medium
Ollama up to version 0.18.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the Model Pull API component (file server/download.go). An attacker can remotely manipulate the request, leading to requests being sent to internal resources.
Original NVD description (English source)
Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid media before passing it to the mtmd_helper_bitmap_init_from_buf function. This function can return NULL for malformed input, but the code does not check this return value before dereferencing the pointer in subsequent operations. A remote attacker can exploit this by sending specially crafted base64 image data that decodes to invalid media, causing a segmentation fault and crashing the runner process. This results in a denial of service condition where the model becomes unavailable to all users until the service is restarted.