Ollama for Windows (versions 0.12.10–0.17.5) contains two critical vulnerabilities…
Ollama for Windows (versions 0.12.10–0.17.5) contains two critical vulnerabilities enabling remote code execution through malicious update payloads without signature verification.
CERT Polska disclosed two critical vulnerabilities in Ollama for Windows affecting versions 0.12.10 through 0.17.5. CVE-2026-42248 represents a complete absence of update integrity verification—the Windows implementation unconditionally returns success without performing digital signature or trust validation, allowing arbitrary executables to be staged and executed. CVE-2026-42249 enables path traversal during update downloads through improper handling of HTTP response headers, permitting attackers to write malicious files to sensitive locations including the Windows Startup directory.
When chained together, these vulnerabilities enable fully automatic remote code execution without user interaction. Because Ollama for Windows performs silent automatic updates, an attacker controlling update infrastructure or performing a man-in-the-middle attack can deliver malicious payloads that are automatically written to the filesystem and executed, achieving persistent code execution. The vendor was notified early in the coordinated disclosure process but did not respond with vulnerability details or affected version ranges.
Organisations running Ollama on Windows should immediately assess their exposure and monitor for indicators of compromise. The automatic update mechanism combined with missing signature verification represents a complete bypass of standard trust boundaries for software updates on Windows platforms.
Mentioned in this report
Detection guidance
File Written to Startup Folder by Ollama Update Process
Detects Ollama Windows processes writing files into the Startup folder, consistent with CVE-2026-42249 path traversal during silent update download leading to persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Written to Startup Folder by Ollama Process
id: 8b81d077-7aa4-54ec-9ef5-2210a3e2227b
status: experimental
description: Detects Ollama for Windows update/installer processes creating files
inside the Startup folder, matching the path traversal write primitive described
in CVE-2026-42249 that can be used to plant persistent malicious executables.
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains: ollama
TargetFilename|contains:
- \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
- \\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
filter:
TargetFilename|endswith:
- .lnk
Image|endswith: \\ollama-installer.exe
condition: selection and not filter
falsepositives:
- Legitimate Ollama installation creating a shortcut for the application in Startup
during normal setup
- Administrator-driven reinstallation or repair of Ollama via signed installer
level: high
tags:
- attack.t1547.001
- attack.t1189
author: Vorant
Ollama Update Process Spawning Unsigned or Unexpected Child Executable
Detects the Ollama updater/service process launching a newly downloaded executable as a child process without prior signature validation, consistent with CVE-2026-42248 unconditional update success and arbitrary code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ollama Updater Spawning Unexpected Child Process
id: dce1110a-07ec-5971-b82e-55b79df5f1db
status: experimental
description: Detects processes named after Ollama's update/installer components spawning
a child process located in temp, downloads, or user profile directories rather than
the standard Ollama install path, indicating potential execution of an unverified
staged update payload (CVE-2026-42248/CVE-2026-42249 chain).
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains:
- \\ollama
- ollama-updater
suspicious_child:
Image|contains:
- \\AppData\\Local\\Temp\\
- \\Downloads\\
- \\Users\\Public\\
filter:
Image|contains: \\Program Files\\Ollama\\
condition: selection and suspicious_child and not filter
falsepositives:
- Legitimate update packages staged in temp directories by other trusted software
update frameworks sharing similar path naming
- Manual reinstall of Ollama from a downloaded installer executed by the user
level: high
tags:
- attack.t1574.001
- attack.t1036.005
- attack.t1553.002
author: Vorant
Ollama Update Network Request Over Unencrypted or Non-Standard Channel
Detects Ollama's update process making outbound HTTP (non-HTTPS) connections for update retrieval, which could indicate exposure to man-in-the-middle delivery of malicious updates given the lack of signature verification. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ollama Process Outbound Update Connection Over Plain HTTP
id: 6d41457f-6423-56d8-b0c3-a47cf09231d4
status: experimental
description: Detects the Ollama Windows binary or its updater component establishing
outbound network connections on port 80 (unencrypted HTTP) which, combined with
the absence of update signature verification (CVE-2026-42248), could enable a man-in-the-middle
attacker to deliver malicious payloads during the silent auto-update process.
logsource:
category: network_connection
product: windows
detection:
selection:
Image|contains:
- \\ollama.exe
- ollama-updater
DestinationPort: 80
condition: selection
falsepositives:
- Internal network proxies or update mirrors intentionally serving updates over HTTP
within isolated lab environments
level: medium
tags:
- attack.t1189
- attack.t1553.002
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-42248
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free