Ollama for Windows update flaws enable silent RCE
Two vulnerabilities in Ollama for Windows allow attackers to deliver and execute malicious code through compromised update channels without user awareness or signature validation.
CERT Polska has disclosed two critical vulnerabilities affecting Ollama for Windows that enable remote code execution through the software's automatic update mechanism. CVE-2026-42248 involves the complete absence of integrity and authenticity verification for downloaded updates — the Windows implementation unconditionally returns success without performing any digital signature or trust validation. CVE-2026-42249 is a path traversal vulnerability that allows attackers to manipulate HTTP response headers during update downloads to write arbitrary executables to sensitive locations, including the Windows Startup directory.
When chained together, these vulnerabilities create a severe attack scenario: an attacker who can compromise or intercept update traffic can deliver malicious payloads that are automatically accepted, written to attacker-chosen locations, and executed without any user interaction. The silent automatic update mechanism in Ollama for Windows means victims remain completely unaware as persistent malware is installed. Versions 0.12.10 through 0.17.5 have been confirmed vulnerable, though other versions may also be affected.
The maintainers were notified early but did not respond with vulnerability details or clarify the full scope of affected versions. The disclosure was coordinated through CERT Polska's responsible vulnerability disclosure process, with credit to Bartłomiej Dmitruk of striga.ai for the initial report.
Mentioned in this report
Detection guidance
Executable Dropped into Startup Folder by Ollama Update Process
Detects an executable file being written to the Windows Startup folder by an Ollama-related process, consistent with exploitation of the unauthenticated/path-traversal update mechanism (CVE-2026-42249) to gain persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable Dropped into Startup Folder by Ollama Process
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains: ollama
TargetFilename|contains: \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
TargetFilename|endswith:
- .exe
- .dll
- .bat
- .cmd
- .lnk
filter:
TargetFilename|contains:
- \\Ollama\\ollama.exe
- \\Ollama\\ollama app.exe
condition: selection and not filter
falsepositives:
- Legitimate Ollama installer or update process creating its own shortcut during normal
first-run setup
- Administrator manually placing an Ollama-related shortcut in Startup for convenience
level: high
tags:
- attack.t1547.001
- attack.persistence
id: ecb024d0-ea54-5645-9a3d-daaf3b78b858
status: experimental
author: Vorant
Ollama Update Process Writing Files Outside Expected Install Directory
Detects an Ollama update/downloader process writing files to locations outside its normal installation directory, indicative of path-traversal abuse of the update mechanism (CVE-2026-42249) to plant arbitrary payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ollama Updater Writing Files Outside Install Path
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains:
- \\Ollama\\
- ollama.exe
- ollama_updater
TargetFilename|endswith:
- .exe
- .dll
- .msi
filter:
TargetFilename|contains:
- \\AppData\\Local\\Programs\\Ollama\\
- \\Program Files\\Ollama\\
- \\Temp\\
condition: selection and not filter
falsepositives:
- Legitimate Ollama update writing new binaries to an alternate but authorized install
path after a user-directed relocation
- Portable or per-user Ollama installations using non-default directories
level: high
tags:
- attack.t1195.001
- attack.initial_access
id: bc0ce13d-fa68-5cd6-8b64-b89a63303c61
status: experimental
author: Vorant
Registry Run Key Created Referencing Ollama-Related Executable Outside Install Path
Detects creation of a Run/RunOnce registry autostart entry pointing to an Ollama-named executable located outside the standard Ollama installation directory, suggesting persistence established via a maliciously delivered update payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Run Key Persistence via Ollama-Named Executable
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- \\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\
- \\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\
Details|contains: ollama
filter:
Details|contains:
- \\Program Files\\Ollama\\
- \\AppData\\Local\\Programs\\Ollama\\
condition: selection and not filter
falsepositives:
- Legitimate Ollama installer registering its standard update-check or tray entry
from an unusual but sanctioned install location
level: medium
tags:
- attack.t1547.001
- attack.t1036.005
- attack.persistence
id: ba2993aa-75a3-58ff-b010-d51f953a8a5d
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-42248
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free