CVE-2026-42249 is a path traversal flaw in the Windows update mechanism of Ollama, scored CVSS 9.8 (critical). Local file paths are built from HTTP response headers without validation. Versions 0.12.10 through 0.17.5 are confirmed affected, and no fixed version is stated, so check Ollama's releases.
What's affected
CERT Polska lists Ollama for Windows from 0.12.10 through 0.17.5 as vulnerable, tested and confirmed. Other versions were not tested and might also be vulnerable. The maintainers did not reply with details of the vulnerable range, and I found no fixed version, so I will not give one.
How to check if you're exposed
- Check the Ollama version in a terminal.
ollama --version
- If it reads from 0.12.10 through 0.17.5, it is in the tested range. Versions outside that range were not tested, so they may be affected too.
- Open the Windows Startup folder for each user and look for files you did not put there.
dir "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup"
- Check how Ollama reaches the internet for updates, and whether that traffic crosses a network you do not control.
What to do now
- List Windows machines running Ollama.
- Check Ollama's release notes for a version after 0.17.5 and whether it mentions the update path. Do not assume a newer version is fixed without that statement.
- Keep affected machines on trusted networks, and avoid updating over public Wi-Fi.
- If no fix is confirmed and you cannot control updates, consider pausing Windows use until one is.
- Review the Startup folder and other autorun locations on those machines for files you do not recognize.
- Read CVE-2026-42248, the missing signature check that makes this one worse.
Why it matters
The classes are CWE-22, path traversal, and CWE-494, download of code without integrity check. When the app downloads an update, it takes a value from the HTTP response headers and joins it onto a local directory. Sequences that climb out of a directory are not stripped, so the file can land outside the intended staging folder.
The record says an attacker who can influence update responses could write an executable to a location the current user can reach, including the Windows Startup folder, which runs programs at login. Combined with CVE-2026-42248, no signature check stands in the way, and since updates are silent the result can be persistent code execution without the user noticing.
The attacker has to be able to alter the update response, which makes untrusted networks the main concern. The KEV flag is false, and I found no report of exploitation in the wild.
Quick check
How do the two Ollama CVEs relate?
CVE-2026-42248 is the missing signature check, and this one is the path handling. The record says chaining them gives automatic, persistent code execution.
Sources
Last reviewed: 19 October 2026.
