CVE-2025-15514: 
NixOS vulnerability analysis and mitigation

CVE-2025-15514 is a null pointer dereference vulnerability in Ollama's multi-modal model image processing functionality that allows unauthenticated remote attackers to cause a denial of service. It affects Ollama versions 0.11.5-rc0 through 0.13.5, including all release candidates and stable releases in that range. The vulnerability was published on January 12, 2026, and is tracked in Red Hat's Bugzilla as Bug 2428828. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in Ollama's image processing code path. When a request is sent to the /api/chat endpoint containing base64-encoded image data, the application decodes the data and passes it directly to the mtmd_helper_bitmap_init_from_buf function without first validating that the decoded bytes represent a valid media format. This function can return NULL when given malformed input, but the calling code does not check the return value before dereferencing the pointer in subsequent operations, triggering a segmentation fault. No authentication or special privileges are required, and the attack vector is entirely network-based with low complexity (Red Hat Bugzilla, Huntr Bounty).

Successful exploitation crashes the Ollama runner process via a segmentation fault, resulting in a denial of service condition that renders the AI model unavailable to all users until the service is manually restarted. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Because no authentication is required and the attack can be triggered remotely with a single crafted HTTP request, any internet-exposed Ollama instance running a multi-modal model is at risk of repeated service disruption (Red Hat Bugzilla, Red Hat Advisory).

A proof-of-concept exploit is publicly available on Huntr.com, where the vulnerability was disclosed through a bug bounty submission. As of the available intelligence, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.195%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Huntr Bounty, Red Hat Advisory).

1. Reconnaissance: Identify internet-facing Ollama instances running versions 0.11.5-rc0 through 0.13.5 using tools like Shodan or Censys, searching for the default Ollama port (11434) or any exposed /api/chat endpoint.
2. Identify multi-modal model: Confirm that the target Ollama instance has a multi-modal (vision-capable) model loaded, such as LLaVA or similar, as the vulnerable code path is only triggered when image data is processed.
3. Craft malformed payload: Construct an HTTP POST request to /api/chat with a JSON body that includes a images field containing base64-encoded data that decodes to invalid or malformed media (e.g., random bytes that do not conform to any valid image format).
4. Send the request: Transmit the crafted request to the target endpoint — no authentication headers or session tokens are required.
5. Trigger crash: The mtmd_helper_bitmap_init_from_buf function returns NULL for the malformed input; the unguarded pointer dereference causes a segmentation fault, crashing the runner process and making the model unavailable to all users until the service is restarted (Red Hat Bugzilla, Huntr Bounty).

• Network: Unexpected or repeated HTTP POST requests to /api/chat from external or untrusted IP addresses containing large or malformed images fields in the JSON body; requests with base64 payloads that do not decode to valid image formats.
• Logs: Ollama service logs showing segmentation fault errors or abrupt runner process termination; repeated service restart events in system logs (e.g., journalctl entries for the Ollama service).
• Process: Sudden termination of the Ollama runner process (e.g., ollama_llava_runner or similar) followed by automatic or manual service restarts; core dump files generated in the Ollama working directory.
• System: Increased frequency of SIGSEGV signals associated with the Ollama process as recorded in system crash logs or /var/log/syslog (Red Hat Bugzilla).

Organizations should upgrade Ollama to a version beyond 0.13.5 where the null pointer dereference has been addressed. If immediate patching is not feasible, restrict network access to the /api/chat endpoint to trusted IP addresses only using firewall rules or a reverse proxy with access controls. Additionally, implement rate limiting on the API endpoint and input validation for image data at the network perimeter. Monitor Ollama service logs for segmentation faults and unexpected crashes as indicators of exploitation attempts (Red Hat Bugzilla, Red Hat Advisory).

The vulnerability was disclosed via the Huntr bug bounty platform and tracked by Red Hat's Product Security team, which assigned it a high severity rating. A brief technical write-up was published at infinitsec.net covering the vulnerability mechanics. Social media activity was limited, with a Bluesky post from a CVE tracking account noting the disclosure. Overall community reaction has been muted, consistent with the low EPSS score and absence of active exploitation (Huntr Bounty, Red Hat Advisory).