Ollama for Windows implements its own update mechanism, but it does not validate HTTP response headers generated by the update server. Values taken from these headers are concatenated into a local file path via filepath.Join, which allows the attacker to supply path traversal sequences such as ">/>". An attacker who can influence the update response can cause the application to write arbitrary files outside the intended update staging area, including executable binaries to the Windows Startup folder, thereby enabling automatic code execution. Chaining this flaw with CVE‑2026‑42248, which removes signature verification for updates, further allows delivery of malicious payloads that are automatically executed by the graceful update process. The primary consequence is that an attacker can execute any code on the target machine with the privileges of the user running the application, including persistence through the Startup mechanism. The weakness is a path traversal flaw (CWE‑22) combined with missing integrity checks (CWE‑494).

The vulnerability affects Ollama for Windows, specifically versions 0.12.10 through 0.17.5 that were verified to be susceptible. While other releases were not examined, they are not guaranteed to be free of the flaw.

The CVSS score of 7.7 reflects the severity of remote code execution with no requirement for user interaction. EPSS is not available, but the flaw is exploitable through the silent automatic update process, meaning an attacker only needs to control the update server response. The issue is not listed in the CISA KEV dataset, yet its impact and automatic execution characteristics make it highly dangerous if an attacker can provide crafted update traffic. An attacker likely exploits this by hosting a malicious update server or intercepting legitimate update traffic, thereby inserting path traversal directives and malicious binaries into the update payload.