{"data":{"id":"dc3f169b-a8c4-488f-91b9-d731b676982c","title":"CVE-2026-42248: Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike…","summary":"Ollama for Windows does not verify the integrity or authenticity of downloaded update executables. Its Windows update verification routine unconditionally returns success, so no digital signature or trust check runs before update payloads are staged or executed, letting attacker-supplied executables be accepted and run. Because updates install silently, a malicious payload may be installed without user awareness. Versions 0.12.10 to 0.17.5 were tested and confirmed vulnerable; other versions were not tested but might also be affected.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42248","publishedAt":"2026-04-29T12:16:18.917Z","cveId":"CVE-2026-42248","cweIds":["CWE-494"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Ollama"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Ollama for Windows update executables accepted without integrity verification","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00733,"epssCheckedAt":"2026-11-09T06:13:51.691Z","kevDateAdded":null,"advisoryAliases":["GHSA-5fjh-wjgp-25ph"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T12:11:03.541Z","patchAvailable":null,"disclosureDate":"2026-04-29T12:16:18.917Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}