On May 5, 2026, researchers at Cyera Research went public with CVE-2026-7482, dubbed Bleeding Llama, an out-of-bounds heap read affecting Ollama (171,189 GitHub stars) that, according to estimates, exposes roughly 300,000 internet-reachable servers. According to the article, three unauthenticated API calls and a carefully crafted GGUF file (Georgi Gerganov Universal Format, the standard format for locally quantized models) can turn a local LLM into a fountain that spits out other people's chats, system prompts, environment variables, and API keys. The attack works because many users think of a GGUF file as an inert blob, but it is a structured container that the loader interprets byte by byte: if the file lies about the declared tensor dimensions and the loader does not validate, the process reads beyond the end of the allocated buffer and hands the attacker whatever it finds next door in the process memory. GGUF was born in August 2023 from the llama.cpp project (109,523 GitHub stars) as an evolution of the GGML, GGJT and GGMF formats; the two letters GG are the initials of Georgi Gerganov, and the acronym officially stands for Universal Format. The article describes GGUF's binary anatomy as three consecutive blocks, with the first four bytes being the magic number.