CVE-2025-15514
Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid media before passing it to the mtmd_helper_bitmap_init_from_buf function. This function can return NULL for malformed input, but the code does not check this return value before dereferencing the pointer in subsequent operations. A remote attacker can exploit this by sending specially crafted base64 image data that decodes to invalid media, causing a segmentation fault and crashing the runner process. This results in a denial of service condition where the model becomes unavailable to all users until the service is restarted.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.78%
- CWE
- CWE-395, CWE-395
- Published
- 2026-01-12
- Last modified
- 2026-08-17
Affected products
- Ollama Ollama
Weakness type
Related vulnerabilities
- CVE-2024-36275 — NULL pointer dereference in some Intel(R) Optane(TM) PMem Management software versions before...
- CVE-2024-28030 — NULL pointer dereference in some Intel(R) VPL software before version 24.1.4 may allow an...
- CVE-2023-23904 — NULL pointer dereference in the UEFI firmware for some Intel(R) Processors may allow a privileged...
- CVE-2023-48727 — NULL pointer dereference in some Intel(R) oneVPL software before version 23.3.5 may allow an...
- CVE-2023-41082 — Null pointer dereference for some Intel(R) CST software before version 2.1.10300 may allow an...
- CVE-2023-25071 — NULL pointer dereference in some Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows Drviers...
- CVE-2022-42879 — NULL pointer dereference in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may...
- CVE-2022-29508 — Null pointer dereference in the Intel(R) VROC software before version 7.7.6.1003 may allow an...