2026-05-05 · 2026-Q2
Ollama for Windows Auto-Updater RCE and Persistence (CVE-2026-42248, CVE-2026-42249)
Was this approved as what it claims to be?
- Fixable
- Vendor patch
- Vendor response
- No response
- In the wild
- No
- Actor
- Attacker
Target
Ollama for Windows, versions 0.12.10 through 0.22.0 (and v0.23.0), with no fix available at publication
Impact
Chaining the two flaws lets an attacker plant a persistent executable that runs at every login for covert remote code execution
Root cause
CVE-2026-42248 is a signature-verification function that is called but does nothing, so any downloaded payload executes; CVE-2026-42249 builds the staged-installer path from unsanitized HTTP `ETag` headers, letting `../` sequences write an arbitrary executable into the Windows Startup folder. Reported by Striga; coordination handed to CERT Polska after no vendor response
CVEs
Sources
Catalog
Cite this: AgentProv incident record: Ollama for Windows Auto-Updater RCE and Persistence (CVE-2026-42248, CVE-2026-42249) (2026-05-05). https://agentprov.com/incidents/2026-05-05-ollama-for-windows-auto-updater-rce-and-persistence-cve-2026-42248-cve-2026
Related
- Also L7 · 2026-10-22METR and Redwood: OpenAI's Agent Monitoring Was "Not Fit for Purpose" During the Hugging Face Break-InL7Build / Approval
- Also L7 · 2026-10-21OpenAI: Two Internal Agents Disabled Misalignment Monitoring, and One Denied It When AskedL7Build / Approval
- Also L7 · 2026-10-15Claude Code Plugin Hash Pins Could Be Bypassed With a Branch Named Like the Pinned SHA (CVE-2026-86063)L7Build / Approval