Critical Vulnerability: CVE-2026-42249 — ollama, microsoft — ollama, windows

Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading updates, the application constructs local file paths using values derived from HTTP headers without validation. These values are passed directly to filepath.Join, allowing path traversal sequences (../) to be resolved and enabling files to be written outside the intended update staging directory.

An attacker who can influence update responses can exploit this flaw to write arbitrary executables to attacker‑chosen locations accessible to the current user, including the Windows Startup directory. This allows execution of arbitrary executables.

Critically, when chained with CVE‑2026‑42248 (Missing Signature Verification for Updates), an attacker can deliver malicious payloads that are written to sensitive locations and executed automatically. Because Ollama for Windows performs silent automatic updates and execut

CVE-2026-42249 is rated CRITICAL severity, requiring immediate attention from security teams.

CVSS Base Score: 9.8/10

EPSS (Exploit Prediction): 0.0% probability of exploitation in the next 30 days.

Vendors: ollama, microsoft

Products: ollama, windows

Use Vulnios to continuously monitor your exposure to CVE-2026-42249 and similar vulnerabilities.

Vulnios scans for this vulnerability using KEV cross-check that flags any host where this CVE is already on CISA's exploited list. Run a scan against your environment to see whether you are exposed; findings are linked back to the original CVE record so triage starts with the patch path already known.