CVE-2024-12055: ollama Out-of-bounds Read
Vulnerability summary
CVE-2024-12055 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in ollama. EPSS estimates a 0.82% chance of exploitation in the next 30 days, higher than 56.6% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Duplicates 1 · Related 2Timeline
- 20-03-2025PublishedVulnerability first disclosed.
- 20-03-2025Last modifiedVulnerability information updated.
Description
A vulnerability in Ollama versions <=0.3.14 allows a malicious user to create a customized gguf model file that can be uploaded to the public Ollama server. When the server processes this malicious model, it crashes, leading to a Denial of Service (DoS) attack. The root cause of the issue is an out-of-bounds read in the gguf.go file.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.82%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
+0.02 pp
From 0.80% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard3 products
- k8sgptAll versions (No fix recorded)
- mods< 1.8.1-r14
- ollama-fipsAll versions (No fix recorded)
Ollama2 products
- ollama≤ 0.3.14
- ollama/ollama≥ unspecified, ≤ latest
Wolfi2 products
- k8sgptAll versions (No fix recorded)
- mods< 1.8.1-r14
Github.com/ollama1 product
- ollama≤ 0.3.14 | All versions (No fix recorded)
4 vendors · 8 products
References
5 links
- github.com/ollama/ollamaPACKAGE