CVE-2026-42248— Missing Signature Verification for Updates in Ollama

Missing Signature Verification for Updates in Ollama

Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verification routine unconditionally returns success so no digital signature or trust validation is performed before staging or executing update payloads, enabling attacker‑supplied executables to be accepted and later executed by the application. Critically, Ollama for Windows performs silent automatic updates, so the malicious payload may be installed automatically without user awareness. Maintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

N/A

下载代码缺少完整性检查

Ollama 安全漏洞

Ollama是Ollama开源的一个可以在本地设备上运行、管理和自定义大语言模型的工具。 Ollama 0.12.10版本至0.17.5版本存在安全漏洞，该漏洞源于下载更新可执行文件时未执行完整性或真实性验证，Windows实现无条件返回成功，在暂存或执行更新有效载荷前未进行数字签名或信任验证，可能导致攻击者提供的可执行文件被接受并执行。

N/A

N/A