Lethal Language Models: From Bit Flip to RCE in Ollama#

Paul Gerste

• Why: First-cycle signal: AI inference infrastructure became a Pwn2Own target category in 2025. Every security org will soon own an LLM-runtime attack surface; this is early, systematic evidence of what it looks like.
• What: Research on Ollama (widely used for running Llama/DeepSeek-R1 locally) in the Pwn2Own Berlin 2025 context: the architecture, the GGUF model-file format, memory-corruption bugs in its handling, and a deep dive turning a bit-flipping primitive into arbitrary code execution on a vulnerable Ollama instance — ending with a live exploit demo and disclosure notes. (from abstract only)
• How: Analysis of how models are serialized to GGUF files and how their parsing yields memory corruption, then exploitation of one bug from bit-flip to full RCE.
• Where applicable: Anyone running Ollama with untrusted model files — the notable framing is that model files are a new "untrusted input" channel for memory corruption.