Remote Code Execution Vulnerability in Ollama for Windows

CVE-2026-42249

What is CVE-2026-42249?

Ollama for Windows features a vulnerability within its update mechanism, stemming from improper handling of HTTP response headers from an attacker. This flaw allows unvalidated values to be used for constructing local file paths, enabling path traversal and permitting arbitrary files to be written outside of the designated update staging directory. An attacker proficient in influencing update responses can exploit this issue to deploy malicious executables into user-accessible locations, including the Windows Startup directory, thus enabling automatic code execution without user intervention. When paired with another identified vulnerability, this flaw facilitates a seamless execution of harmful payloads that can manifest persistently and unnoticed in affected systems.

References