EUVD-2026-26210Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A and AC:H because exploitation needs an adjacent man-in-the-middle position on the update channel; PR:N/UI:N due to silent unattended updates, with full C/I/A from code execution.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verification routine unconditionally returns success so no digital signature or trust validation is performed before staging or executing update payloads, enabling attacker‑supplied executables to be accepted and later executed by the application.
Critically, Ollama for Windows performs silent automatic updates, so the malicious payload may be installed automatically without user awareness.
Maintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
AnalysisAI
Silent auto-update code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) stems from an update-verification routine that unconditionally returns success, so no signature or trust check is performed before staging and executing downloaded update payloads (CWE-494). Because Ollama on Windows applies updates silently and automatically, an attacker who can substitute the update executable can have arbitrary code installed and run without user awareness. No public exploit identified at time of analysis; EPSS is very low (0.01%) and CISA SSVC records exploitation as none, though technical impact is rated total.
Technical ContextAI
Ollama is a local large-language-model runtime that ships a built-in auto-update mechanism. On non-Windows platforms the client validates the digital signature/authenticity of the downloaded installer before running it, but the Windows implementation of that verification function is effectively a stub that always returns success, so any bytes delivered as the 'update' are accepted. This is a textbook CWE-494 (Download of Code Without Integrity Check): the trust decision that should gate execution has been removed on one platform. The affected component is the Ollama Windows client itself (CPE cpe:2.3:a:ollama:ollama), and the impact is code execution in the security context of the updating process.
RemediationAI
No vendor-released patch identified at time of analysis - CERT-PL reports the maintainers were notified early but did not respond with a fix or an authoritative vulnerable-version range, so no fixed version can be cited. Until a signed release confirming the verification routine is restored on Windows is published, compensating controls are required: disable or block Ollama's automatic update mechanism where the platform allows, and prevent the client from silently fetching updates by restricting outbound access from Ollama hosts to only trusted, TLS-pinned update endpoints (trade-off: manual updates must then be applied and verified out-of-band). Ensure hosts run Ollama only on trusted networks and enforce network-layer protections (e.g., prevent ARP/DNS spoofing, require validated TLS) to remove the adjacent man-in-the-middle position the attack needs (trade-off: does not fix the underlying missing check). Monitor the Ollama install directory for unexpected executable changes as a detection control. Track https://cert.pl/en/posts/2026/04/CVE-2026-42248/ and https://ollama.com/ for a patched build and upgrade as soon as one is available.
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path,
Denial of service in Ollama's multi-modal image processing (versions 0.11.5-rc0 through 0.13.5) lets remote attackers cr
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 8.2), this vulnerability is remotely exploita
A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function rea
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder [CVSS 7.5 HIGH]
A divide by zero vulnerability exists in ollama/ollama version v0.3.3. Rated high severity (CVSS 7.5), this vulnerabilit
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to create a customized GGUF model file that,
A vulnerability in Ollama versions <=0.3.14 allows a malicious user to create a customized gguf model file that can be u
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
An issue was discovered in Ollama before 0.1.34. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Same weakness CWE-494 – Download of Code Without Integrity Check
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today