DEF CON 34 - Main - Breaking Local AI Runtimes Exploiting llama cpp & Ollama - V Tokarev, O Itach
Source: YouTube · DEFCONConference · published Nov 6, 2026 · 45:54
BLUF: Checkmarx researchers present 13 vulnerabilities (11 CVEs) in local AI inference engines llama.cpp and Ollama, including exploitable use-after-free bugs and a heap memory leak 2:16-3:05.
Key Takeaways:
• ~151,000 unauthenticated llama.cpp/Ollama servers are exposed globally 1:54-2:12.
• An Android JNI race condition enables a UAF; researchers achieved full memory reclaim and code execution in a demo app 9:58-16:25.
• llama-server's --sleep-idle-seconds leaves dangling vocab pointers, allowing heap reclaim (remote code execution not fully completed) 18:10-28:35.
• Ollama's unvalidated GGUF tensor shapes enable an OOB heap leak via forced lossless F16→F32 conversion, exfiltrated through model upload 35:25-39:33.
• 30,000+ Ollama servers were exposed without authentication; that bug was quickly patched 39:33-40:07.
• llama.cpp handled disclosure poorly (patches closed unexplained); the team published their own fixes for five unfixed bugs 42:17-43:44.
Despite their novelty, these engines remain classic unsafe C/C++/Go code—defenses include authentication, restricting model uploads, and integer overflow checks 45:02-45:34.
Sources:
- 2:16-3:05 Overview: 13 vulns, 11 CVEs
- 9:58-16:25 Android JNI UAF exploit
- 18:10-28:35 llama-server UAF
- 35:25-39:33 Ollama OOB heap leak
- 42:17-43:44 Disclosure comparison
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Thank you for being here. Unfortunately, the main speaker, Vladimir, couldn't reach it today because of personal issues. And what we will do, I will be here for questions and we pre-recorded the sessions. So hopefully you will like this. We work really hard on that and have a good day. Thank you for coming. Thank you for joining us today. >> Now let's start with insurance. Alm will uh basically based on this input uh predict the next tokens and so there are two types of inferences. You have remote inference such as entropic, openi, open router uh where you send your prompt to other vendor and this is travels across the internet and reaches to their uh data center and then you have local inferences such as as OA which is is a very popular inference engine. It has almost 180,000 stars on Git…