CVE-2026-42248: Ollama for Windows update executables accepted without integrity verification

Summary

Ollama for Windows does not verify the integrity or authenticity of downloaded update executables. Its Windows update verification routine unconditionally returns success, so no digital signature or trust check runs before update payloads are staged or executed, letting attacker-supplied executables be accepted and run. Because updates install silently, a malicious payload may be installed without user awareness. Versions 0.12.10 to 0.17.5 were tested and confirmed vulnerable; other versions were not tested but might also be affected.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Inference infrastructure

Related items

• MediumTop MCP security resources — November 2026Similar attack · Adversa AI Blog
• MediumAI broke the cybersecurity world. What’s next?Similar attack · The Verge (AI)
• InfoGem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization FrameworkSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
• MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog