# Ollama for Windows update flaws enable silent RCE

Published: 2026-04-29 · Severity: critical
Canonical: https://vorant.io/reports/a91c1ba2-913a-5d07-b359-af37335615d9/ollama-for-windows-update-flaws-enable-silent-rce

> Two vulnerabilities in Ollama for Windows allow attackers to deliver and execute malicious code through compromised update channels without user awareness or signature validation.

CERT Polska has disclosed two critical vulnerabilities affecting Ollama for Windows that enable remote code execution through the software's automatic update mechanism. CVE-2026-42248 involves the complete absence of integrity and authenticity verification for downloaded updates — the Windows implementation unconditionally returns success without performing any digital signature or trust validation. CVE-2026-42249 is a path traversal vulnerability that allows attackers to manipulate HTTP response headers during update downloads to write arbitrary executables to sensitive locations, including the Windows Startup directory.

When chained together, these vulnerabilities create a severe attack scenario: an attacker who can compromise or intercept update traffic can deliver malicious payloads that are automatically accepted, written to attacker-chosen locations, and executed without any user interaction. The silent automatic update mechanism in Ollama for Windows means victims remain completely unaware as persistent malware is installed. Versions 0.12.10 through 0.17.5 have been confirmed vulnerable, though other versions may also be affected.

The maintainers were notified early but did not respond with vulnerability details or clarify the full scope of affected versions. The disclosure was coordinated through CERT Polska's responsible vulnerability disclosure process, with credit to Bartłomiej Dmitruk of striga.ai for the initial report.

## Mentioned in this report

- Vulnerabilities: CVE-2026-42248, CVE-2026-42249

## Detection guidance (public sample)

### Executable Dropped into Startup Folder by Ollama Update Process

ATT&CK: T1547.001

Detects an executable file being written to the Windows Startup folder by an Ollama-related process, consistent with exploitation of the unauthenticated/path-traversal update mechanism (CVE-2026-42249) to gain persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Executable Dropped into Startup Folder by Ollama Process
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|contains: ollama
    TargetFilename|contains: \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
    TargetFilename|endswith:
    - .exe
    - .dll
    - .bat
    - .cmd
    - .lnk
  filter:
    TargetFilename|contains:
    - \\Ollama\\ollama.exe
    - \\Ollama\\ollama app.exe
  condition: selection and not filter
falsepositives:
- Legitimate Ollama installer or update process creating its own shortcut during normal
  first-run setup
- Administrator manually placing an Ollama-related shortcut in Startup for convenience
level: high
tags:
- attack.t1547.001
- attack.persistence
id: ecb024d0-ea54-5645-9a3d-daaf3b78b858
status: experimental
author: Vorant
```

### Ollama Update Process Writing Files Outside Expected Install Directory

ATT&CK: T1195.001

Detects an Ollama update/downloader process writing files to locations outside its normal installation directory, indicative of path-traversal abuse of the update mechanism (CVE-2026-42249) to plant arbitrary payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ollama Updater Writing Files Outside Install Path
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|contains:
    - \\Ollama\\
    - ollama.exe
    - ollama_updater
    TargetFilename|endswith:
    - .exe
    - .dll
    - .msi
  filter:
    TargetFilename|contains:
    - \\AppData\\Local\\Programs\\Ollama\\
    - \\Program Files\\Ollama\\
    - \\Temp\\
  condition: selection and not filter
falsepositives:
- Legitimate Ollama update writing new binaries to an alternate but authorized install
  path after a user-directed relocation
- Portable or per-user Ollama installations using non-default directories
level: high
tags:
- attack.t1195.001
- attack.initial_access
id: bc0ce13d-fa68-5cd6-8b64-b89a63303c61
status: experimental
author: Vorant
```

### Registry Run Key Created Referencing Ollama-Related Executable Outside Install Path

ATT&CK: T1547.001

Detects creation of a Run/RunOnce registry autostart entry pointing to an Ollama-named executable located outside the standard Ollama installation directory, suggesting persistence established via a maliciously delivered update payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Run Key Persistence via Ollama-Named Executable
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
    - \\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\
    - \\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\
    Details|contains: ollama
  filter:
    Details|contains:
    - \\Program Files\\Ollama\\
    - \\AppData\\Local\\Programs\\Ollama\\
  condition: selection and not filter
falsepositives:
- Legitimate Ollama installer registering its standard update-check or tray entry
  from an unusual but sanctioned install location
level: medium
tags:
- attack.t1547.001
- attack.t1036.005
- attack.persistence
id: ba2993aa-75a3-58ff-b010-d51f953a8a5d
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-42248

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a91c1ba2-913a-5d07-b359-af37335615d9/ollama-for-windows-update-flaws-enable-silent-rce.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup