Ollama Windows updater flaws enable silent RCE
Two chained flaws in Ollama for Windows let attackers bypass update signature checks and path-traverse malicious payloads into the Startup folder for silent, automatic code execution.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2026-42248 (weaponized) and CVE-2026-42249 (weaponized); no exploitation in the wild is recorded.
CERT Polska coordinated disclosure of two vulnerabilities affecting Ollama for Windows' auto-update mechanism. CVE-2026-42248 shows that, unlike other platforms, the Windows update verification routine unconditionally returns success, meaning no digital signature or trust validation is performed before staging or executing update payloads. CVE-2026-42249 is a path traversal RCE where attacker-controlled HTTP response headers are used to construct local file paths via filepath.Join without sanitization, allowing writes outside the intended staging directory—including into the Windows Startup folder.
When chained, an attacker capable of influencing update responses (e.g., via a man-in-the-middle or compromised update channel) can deliver a malicious executable that is written to a persistence location and silently executed without any user interaction, since Ollama for Windows performs automatic updates by default. This results in automatic, persistent code execution without user awareness.
Versions 0.12.10 through 0.17.5 were confirmed vulnerable during testing; other versions were untested but may also be affected. The maintainers were notified early but did not respond with vulnerability details or a confirmed affected version range, leaving the full scope of impact unclear. No patch status or exploitation-in-the-wild evidence is mentioned in the report.
Mentioned in this report
Detection guidance
Ollama Process Writing to Windows Startup Folder
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Ollama or related update processes writing executable files to Windows Startup directories, indicating persistence via path traversal in the update mechanism. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ollama Process Writing to Windows Startup Folder
description: Detects Ollama or related processes (ollama.exe, update utilities) writing
.exe or .cmd files to Windows Startup folders. CVE-2026-42249 path traversal allows
update payloads to be staged in persistence locations.
tags:
- attack.persistence
- attack.t1547.001
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \ollama.exe
- \ollama-launcher.exe
TargetFilename|contains:
- \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
- \ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
TargetFilename|endswith:
- .exe
- .cmd
- .bat
- .vbs
- .ps1
condition: selection
falsepositives:
- Legitimate Ollama installer adding uninstaller shortcuts to Startup folder
level: high
id: c44bac98-5759-588b-8455-e5ca235d3209
status: experimental
author: Vorant
Ollama Update Process Loading Without Code Signature Validation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Ollama update mechanism executing downloaded executables that may lack proper digital signature validation, characteristic of CVE-2026-42248. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ollama Update Process Loading Without Code Signature Validation
description: Detects Ollama update-related processes (ollama.exe, ollama-update, update
utilities) spawning child processes from the update staging directory without preceding
signature validation events. CVE-2026-42248 bypasses signature checks on Windows.
tags:
- attack.defense-impairment
- attack.t1553.002
logsource:
category: process_creation
product: windows
detection:
selection_ollama_child:
ParentImage|endswith:
- \ollama.exe
- \ollama-launcher.exe
- \ollama-update.exe
Image|endswith: .exe
CommandLine|contains:
- \AppData\Local
- \Temp\
- \ProgramData\
filter_signed_paths:
Image|startswith:
- C:\Program Files
- C:\Program Files (x86)\
- C:\Windows\System32\
condition: selection_ollama_child and not filter_signed_paths
falsepositives:
- Ollama legitimately launching helper utilities from its staging directory
level: medium
id: d9072ab6-a948-51cc-8c87-ad4493bc4220
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-42248
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs