PYSEC-2026-102

vendorUSosv

view advisory published 2026-01-21Licence: CC-BY-4.0

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length from untrusted GGUF metadata

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-66960US	—	0.43% (37th)	—	2026-01-21
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length from untrusted GGUF meta…

references

External citations — patches, advisories, analysis.

https://github.com/ollama/ollama/issues/9820REPORT
https://zero.shotlearni.ng/blog/cve-2025-66960guf-v1-string-length-cause-panic-in-readggufv1string/EVIDENCE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan