EUVD-2026-26211Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
On-path control of update responses gives AV:A and AC:H; no auth or interaction (PR:N/UI:N); silent unsigned update yields full C/I/A on the host with no privilege-boundary change (S:U).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading updates, the application constructs local file paths using values derived from HTTP headers without validation. These values are passed directly to filepath.Join, allowing path traversal sequences (../) to be resolved and enabling files to be written outside the intended update staging directory. An attacker who can influence update responses can exploit this flaw to write arbitrary executables to attacker‑chosen locations accessible to the current user, including the Windows Startup directory. This allows execution of arbitrary executables.
Critically, when chained with CVE‑2026‑42248 (Missing Signature Verification for Updates), an attacker can deliver malicious payloads that are written to sensitive locations and executed automatically. Because Ollama for Windows performs silent automatic updates and executes staged binaries without user interaction, this results in automatic and persistent code execution without user awareness.
Maintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
AnalysisAI
Remote code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) lets an attacker who can influence HTTP update responses write arbitrary executables outside the update staging directory. The flaw stems from unvalidated attacker-controlled HTTP headers being passed to filepath.Join, permitting path traversal into sensitive locations such as the Windows Startup folder. Chained with CVE-2026-42248 (missing update signature verification), the silent auto-updater executes the planted binary, yielding automatic and persistent code execution with no user interaction. There is no public exploit identified at time of analysis and EPSS is very low (0.03%).
Technical ContextAI
Ollama is a local large-language-model runtime; its Windows build ships a background auto-update client that downloads and stages update binaries over HTTP. The root cause is CWE-494 (download of code without integrity check) compounded by a path-traversal primitive: the updater derives local destination file names from server-supplied HTTP response headers and concatenates them with filepath.Join without sanitizing '../' sequences. In Go, filepath.Join cleans but does not confine paths, so traversal segments resolve to arbitrary user-writable directories. Because a companion defect (CVE-2026-42248) omits signature verification of the downloaded payload, the integrity control that would otherwise stop a malicious update is absent, turning a write-primitive into reliable code execution. The affected component is identified by CPE cpe:2.3:a:ollama:ollama and tagged Microsoft / Path Traversal / RCE.
RemediationAI
No vendor-released patch identified at time of analysis - the maintainers were notified but did not provide a fixed version, so no exact upgrade target can be cited. As compensating controls, prevent the man-in-the-middle precondition and the silent-update primitive: enforce that update traffic uses validated TLS and cannot be intercepted (avoid untrusted networks/proxies for hosts running Ollama, pin or monitor the ollama.com update endpoint), which does not fix the traversal but removes the attacker's ability to inject responses. Where feasible, disable or block Ollama's automatic update mechanism (trade-off: you must then patch manually and will miss legitimate fixes), and restrict write access to and monitor the Windows Startup directory and the update staging path for unexpected executables (trade-off: detective, not preventive). Consider pausing deployment of Ollama for Windows on sensitive hosts until a signed, path-validated update build is published. Track vendor updates via https://ollama.com/ and https://cert.pl/en/posts/2026/04/CVE-2026-42248/ ; correlate fix availability with the companion CVE-2026-42248 signature-verification fix.
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path,
Denial of service in Ollama's multi-modal image processing (versions 0.11.5-rc0 through 0.13.5) lets remote attackers cr
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 8.2), this vulnerability is remotely exploita
A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function rea
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder [CVSS 7.5 HIGH]
A divide by zero vulnerability exists in ollama/ollama version v0.3.3. Rated high severity (CVSS 7.5), this vulnerabilit
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to create a customized GGUF model file that,
A vulnerability in Ollama versions <=0.3.14 allows a malicious user to create a customized gguf model file that can be u
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
An issue was discovered in Ollama before 0.1.34. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Same weakness CWE-494 – Download of Code Without Integrity Check
View allShare
External POC / Exploit Code
Leaving vuln.today