Ollama for Windows remote code execution via unsigned updates
Ollama for Windows (versions 0.12.10–0.17.5) contains two critical vulnerabilities enabling remote code execution through malicious update payloads without signature verification.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2026-42248 (weaponized) and CVE-2026-42249 (weaponized); no exploitation in the wild is recorded.
CERT Polska disclosed two critical vulnerabilities in Ollama for Windows affecting versions 0.12.10 through 0.17.5. CVE-2026-42248 represents a complete absence of update integrity verification—the Windows implementation unconditionally returns success without performing digital signature or trust validation, allowing arbitrary executables to be staged and executed. CVE-2026-42249 enables path traversal during update downloads through improper handling of HTTP response headers, permitting attackers to write malicious files to sensitive locations including the Windows Startup directory.
When chained together, these vulnerabilities enable fully automatic remote code execution without user interaction. Because Ollama for Windows performs silent automatic updates, an attacker controlling update infrastructure or performing a man-in-the-middle attack can deliver malicious payloads that are automatically written to the filesystem and executed, achieving persistent code execution. The vendor was notified early in the coordinated disclosure process but did not respond with vulnerability details or affected version ranges.
Organisations running Ollama on Windows should immediately assess their exposure and monitor for indicators of compromise. The automatic update mechanism combined with missing signature verification represents a complete bypass of standard trust boundaries for software updates on Windows platforms.
Mentioned in this report
Detection guidance
File Written to Startup Folder by Ollama Update Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Ollama Windows processes writing files into the Startup folder, consistent with CVE-2026-42249 path traversal during silent update download leading to persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Written to Startup Folder by Ollama Process
id: 8b81d077-7aa4-54ec-9ef5-2210a3e2227b
status: experimental
description: Detects Ollama for Windows update/installer processes creating files
inside the Startup folder, matching the path traversal write primitive described
in CVE-2026-42249 that can be used to plant persistent malicious executables.
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains: ollama
TargetFilename|contains:
- \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
- \\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
filter:
TargetFilename|endswith:
- .lnk
Image|endswith: \\ollama-installer.exe
condition: selection and not filter
falsepositives:
- Legitimate Ollama installation creating a shortcut for the application in Startup
during normal setup
- Administrator-driven reinstallation or repair of Ollama via signed installer
level: high
tags:
- attack.t1547.001
- attack.t1189
author: Vorant
Ollama Update Process Spawning Unsigned or Unexpected Child Executable
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the Ollama updater/service process launching a newly downloaded executable as a child process without prior signature validation, consistent with CVE-2026-42248 unconditional update success and arbitrary code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ollama Updater Spawning Unexpected Child Process
id: dce1110a-07ec-5971-b82e-55b79df5f1db
status: experimental
description: Detects processes named after Ollama's update/installer components spawning
a child process located in temp, downloads, or user profile directories rather than
the standard Ollama install path, indicating potential execution of an unverified
staged update payload (CVE-2026-42248/CVE-2026-42249 chain).
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains:
- \\ollama
- ollama-updater
suspicious_child:
Image|contains:
- \\AppData\\Local\\Temp\\
- \\Downloads\\
- \\Users\\Public\\
filter:
Image|contains: \\Program Files\\Ollama\\
condition: selection and suspicious_child and not filter
falsepositives:
- Legitimate update packages staged in temp directories by other trusted software
update frameworks sharing similar path naming
- Manual reinstall of Ollama from a downloaded installer executed by the user
level: high
tags:
- attack.t1574.001
- attack.t1036.005
- attack.t1553.002
author: Vorant
Ollama Update Network Request Over Unencrypted or Non-Standard Channel
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Ollama's update process making outbound HTTP (non-HTTPS) connections for update retrieval, which could indicate exposure to man-in-the-middle delivery of malicious updates given the lack of signature verification. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ollama Process Outbound Update Connection Over Plain HTTP
id: 6d41457f-6423-56d8-b0c3-a47cf09231d4
status: experimental
description: Detects the Ollama Windows binary or its updater component establishing
outbound network connections on port 80 (unencrypted HTTP) which, combined with
the absence of update signature verification (CVE-2026-42248), could enable a man-in-the-middle
attacker to deliver malicious payloads during the silent auto-update process.
logsource:
category: network_connection
product: windows
detection:
selection:
Image|contains:
- \\ollama.exe
- ollama-updater
DestinationPort: 80
condition: selection
falsepositives:
- Internal network proxies or update mirrors intentionally serving updates over HTTP
within isolated lab environments
level: medium
tags:
- attack.t1189
- attack.t1553.002
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-42248
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs