Two vulnerabilities in widely-deployed AI infrastructure received CVE identifiers on 7 September at 09:17 UTC. CVE-2026-86289 covers an integer overflow in Ollama's GGUF decoder, in readGGUFV1String in fs/ggml/gguf.go, affecting versions up to 0.31.1. CVE-2026-86288 covers an out-of-bounds read in GPTQModel's Triton dequantisation kernel, reachable through an unchecked g_idx argument in a model checkpoint, affecting versions up to 7.2.0.
What the framing gets wrong
A CVE publication date is not a discovery date, and here the gap is two months. The Ollama issue was opened on 4 July 2026 and the GPTQModel issue on 14 July 2026; both are closed, both have merged pull requests, and fixes shipped in Ollama 0.31.2-rc1 and GPTQModel 7.3.0. Anyone reading today's identifiers as newly discovered holes in the AI stack has the timeline backwards — this is the CVE record catching up with maintenance that already happened.
The severity depends on which scale you read
Both records carry three scores. Under CVSS v4.0 each rates 2.1 LOW. Under CVSS v3.1 the Ollama flaw is 4.3 MEDIUM and the GPTQModel flaw 6.3 MEDIUM. Under the legacy CVSS v2.0 they are 5.0 and 7.5. A single flaw described as either 2.1 or 7.5 is not a contradiction in the data; it is three scoring systems weighting user interaction and scope differently. It does mean any "high severity" or "low severity" headline is a choice of scale, usually unstated.
The real exposure is the file format
Both bugs are triggered by malicious model files rather than network traffic — a crafted GGUF in one case, a crafted quantised checkpoint in the other. That is the structural point worth carrying: downloading a model from a public hub is executing a parser against untrusted input, and the parsers are young. NVD lists both exploits as publicly disclosed, and both records remain in Received status, meaning NVD has not completed its own analysis.