Ollama EUVD-2026-26210

Exploitation requires the attacker to control or tamper with the update executable Ollama for Windows downloads - in practice an adjacent-network man-in-the-middle position on the update channel or a compromised/impersonated update source (reflected in AV:A and AT:P, the 'attack requirement present' flag). The target must be running Ollama's Windows build in the confirmed range 0.12.10-0.17.5 with automatic updates active (the default, silent behavior). No authentication and no user interaction are needed once the attacker can supply the payload (PR:N/UI:N), and the silent update means the victim receives no warning. Limiting factors: the flaw is Windows-only (macOS/Linux perform the skipped check), the attacker cannot exploit purely remotely from an arbitrary Internet location without a network/update-channel foothold, and reachability depends on the client actually performing an update check while the attacker holds position.

Signals here are mixed and should temper the 7.7 CVSS 4.0 score. The vector (AV:A/AC:L/AT:P) requires an adjacent-network position and a present attack requirement - the attacker must be able to tamper with or impersonate the update download channel (e.g., man-in-the-middle on the network path or a compromised update endpoint), not merely send a packet from anywhere on the Internet. That materially constrains real-world exploitability, which is consistent with the very low EPSS (0.01%, 1st percentile) and CISA SSVC marking Exploitation as 'none' and Automatable as 'no'. Countervailing factors are severe: technical impact is 'total', the update runs silently with no user interaction (PR:N/UI:N), and the flaw affects the trust anchor of the whole update process, so a successful attack yields full host compromise. Net: not a mass-exploitation, drop-everything issue, but a high-severity supply-chain/update-integrity weakness that becomes serious for anyone on untrusted networks or facing a capable adjacent attacker. The 'Information Disclosure' tag understates the true impact, which is arbitrary code execution.

An attacker who shares an adjacent network with a target (e.g., the same corporate LAN, VPN segment, or public Wi-Fi) positions themselves as a man-in-the-middle on Ollama's update traffic and serves a malicious executable when the Windows client checks for updates. Because the Windows verification routine always returns success, the tampered payload passes the integrity check and Ollama's silent auto-update stages and executes it without any user prompt, giving the attacker code execution on the host. No public exploit code is known, but the attack is straightforward for anyone already holding the required network position.