Ollama Model Loading RCE: Three Years of the Same Bug Class, One Self-Hosted LLM Runtime

Short summary

Ollama has shipped three RCE vulnerabilities in three years, all at the model-loading boundary — path traversal, ZipSlip, and an out-of-bounds write in MLLAMA metadata parsing. The root cause is structural: model files are treated as data but parsed as code, with insufficient validation of metadata lengths and paths. Anyone running ollama pull on untrusted registries should upgrade to 0.7.0 immediately, as default deployments bind to 0.0.0.0 with no auth.

• •Three RCE bugs in three years share the same root cause: untrusted model file parsing
• •Latest OOB write affects all Ollama versions before 0.7.0 via crafted MLLAMA metadata
• •Default deployments expose Ollama on 0.0.0.0:11434 with no authentication

Generated with AI, which can make mistakes.