Ollama CVE-2026-42249

Exploitation requires the attacker to control or tamper with the HTTP response to Ollama for Windows' automatic update request - i.e., an adjacent-network or on-path (MITM) position such as a shared LAN/Wi-Fi, malicious proxy, or DNS/route hijack (reflected as AV:A and the AT:P attack requirement in the CVSS 4.0 vector). The vulnerable feature is specifically the update-download routine that builds local file paths from attacker-controlled HTTP headers via filepath.Join without validation, and the impact chain depends on the companion missing-signature-verification flaw (CVE-2026-42248) so the planted binary is accepted and run. No authentication and no user interaction are needed once the attacker is on-path (PR:N/UI:N), and silent auto-update plus execution of staged binaries makes it fully automatic. Limiting factors: only Ollama for Windows in the 0.12.10-0.17.5 range is confirmed; the required privileged network position and AC:H raise the practical bar; and files are written only to locations writable by the current user (no privilege escalation is claimed).

The signals are mixed and point to a serious-but-not-mass-exploited issue. The vendor CVSS 4.0 base score is 7.7 (High) with vector AV:A/AC:H/AT:P/PR:N/UI:N and total technical impact, but the AV:A (adjacent), AC:H, and AT:P metrics show exploitation is gated on a privileged network position: the attacker must be able to intercept or control the update HTTP response (MITM, malicious proxy, DNS/BGP hijack, or compromised update path). CISA SSVC scores Exploitation: none, Automatable: no, Technical Impact: total - consistent with high damage but no easy, scalable exploitation. EPSS is 0.03% (10th percentile), and the issue is not in CISA KEV, so this is not evidence of active or widespread exploitation. Net: a genuine high-impact chain (unauthenticated, no user interaction, persistent RCE) whose real-world risk is throttled by the man-in-the-middle prerequisite rather than a low-value high-CVSS false alarm. Note the input provides only a CVSS 4.0 vector (no 3.1 vector), so auth is read from PR:N in the 4.0 string.

An attacker positioned on the same network segment or in the update path (e.g., a rogue Wi-Fi hotspot, malicious proxy, or DNS/route hijack) intercepts Ollama's automatic update request and returns a crafted HTTP response whose headers contain '../' traversal sequences and a malicious executable. Ollama writes the binary into the Windows Startup directory and, because updates are unsigned and applied silently, the payload executes automatically on next logon with no user interaction. No public exploit is identified at time of analysis, but the technique is well-documented by CERT-PL.