CVE-2025-66960

PYSEC-2026-102 · CVE-2025-66960

Published Jan 21, 2026 · Modified Jun 10, 2026

Description

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length from untrusted GGUF metadata

References

REPORT https://github.com/ollama/ollama/issues/9820
EVIDENCE https://zero.shotlearni.ng/blog/cve-2025-66960guf-v1-string-length-cause-panic-in-readggufv1string/

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes