CVE-2026-42248Disclosure(microsoft / ollama)

> run Claude Code root-level on your computer > paste in the following prompt: Audit my MacBook for exposure to the Ollama vulnerabilities disclosed on May 10, 2026 (CVE-2026-7482 "Bleeding Llama" — heap out-of-bounds read in GGUF loader on `/api/create`, fixed in 0.17.1; and CVE-2026-42248 / CVE-2026-42249 — Windows-only updater flaws affecting 0.12.10–0.22.0, can be skipped since this is macOS but confirm no Windows VM/Parallels instance is running Ollama) and produce a single concise final report — do not fix anything, only diagnose. Specifically: (1) check if Ollama is installed and get its version with `ollama --version` and `which ollama`, then compare against 0.17.1 to determine if the GGUF flaw applies; (2) determine whether the Ollama server is currently running and on what interface — run `lsof -nP -iTCP:11434 -sTCP:LISTEN` and `ps aux | grep -i ollama` to see if it's bound to `127.0.0.1` (safe, loopback only) or `0.0.0.0`/`*` (listening on all interfaces, network-reachable); (3) check the launch environment for `OLLAMA_HOST` — inspect `launchctl getenv OLLAMA_HOST`, `~/.zshrc`, `~/.zprofile`, `~/.bash_profile`, `~/.bashrc`, and any LaunchAgents/LaunchDaemons under `~/Library/LaunchAgents` and `/Library/LaunchAgents` for persistent `OLLAMA_HOST=0.0.0.0` settings; (4) determine the local network exposure layer — get the LAN IP with `ifconfig | grep "inet "`, check the macOS application firewall state with `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate` and whether Ollama is allowed/blocked, and note that even if bound to `0.0.0.0` the box is only LAN-reachable unless the upstream router forwards port 11434 (which the agent cannot verify from inside the host — flag this as a manual check); (5) check for any reverse proxy, Tailscale, ngrok, Cloudflare Tunnel, or similar tunneling tool that could expose 11434 publicly — run `ps aux | grep -E "ngrok|cloudflared|tailscaled|frp"` and `ls ~/Library/LaunchAgents`; (6) confirm no Windows Ollama instance is running in a Parallels/VMware/UTM VM by listing running VMs if any virtualization software is installed. Then output one short final report with: Ollama version + vulnerable yes/no, listening interface (loopback vs all), `OLLAMA_HOST` env state, LAN IP, tunneling tools detected, and a one-line verdict — "likely affected", "only-if-router-forwards-11434", or "not affected" — plus the single most important action to take. Do not modify any files, do not stop or start Ollama, do not change firewall rules.

We reported CVE-2026-42248 and CVE-2026-42249 to @ollama on January 27. It is still unpatched. Read write-up on our findings here -> https://www.striga.ai/research/ollama-windows-auto-update-rce

Persistent RCE in @ollama's Windows auto-updater. An HTTP header decides where the downloaded file lands on disk. The signature check that would catch this is one line: return nil. Windows runs the dropped binary every login. CVE-2026-42248 + CVE-2026-42249. Affected: 0.12.10 - 0.22.0. Still unpatched after the 90-day disclosure window. Thanks to @CERT_Polska for picking up coordination with the vendor unresponsive. https://striga.ai/research/ollama-windows-auto-update-rce

@Dinosn Regarding Ollama, here is our article in which we explain our findings covered in THN article (CVE-2026-42248, CVE-2026-42249). We reported those in Jan, 2026, and the newest release is still unpatched. https://www.striga.ai/research/ollama-windows-auto-update-rce

CVE-2026-42248 Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the… https://www.cve.org/CVERecord?id=CVE-2026-42248

Top 5 Trending CVEs: 1 - CVE-2026-6973 2 - CVE-2026-41940 3 - CVE-2026-43284 4 - CVE-2026-33634 5 - CVE-2026-42248 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

3🪟 で,Windows版には更新機構に関する深刻な脆弱性(CVE-2026-42248 / 42249）が未修正の儘残ってる! Windowsユーザは自動更新をオフに 公式サイトから手動で最新版をインストールすること! デフォルトのlocalhost運用に戻すだけでも大幅にリスクを下げられる 環境見直していこー 🔗なんかは元🧵に

3🪟 - 認証不要,攻撃コストが極めて低い - 0.17.1以降で修正済み Windows版の別脆弱性 CVE-2026-42248 / 42249(更新機構の問題)現在も未修正! Windows環境では自動更新を無効化,公式GitHubから手動更新 組織サーバ運用向けベストプラクティス - 基本：OLLAMA_HOST=127.0.0.1 の儘運用(外部公開極避け

CVE-2026-7482 "Bleeding Llama" — CVSS 9.1, unauthenticated remote attack, 300,000+ exposed Ollama servers. This one has a data-specific impact that deserves attention beyond the patch advisory. The exploit chain is three steps: upload a malformed GGUF via HTTP POST, trigger the read through the /api/create endpoint, exfiltrate the heap contents via /api/push. No authentication required." The vulnerability sits in Ollama's GGUF model loader. A crafted file with inflated tensor offset values causes the server to read beyond allocated heap boundaries — and what's in that heap is the problem. Separate Windows flaws compound this. CVE-2026-42248 and CVE-2026-42249 (both CVSS 7.7, currently unpatched) combine missing update binary signature verification with a path traversal that allows arbitrary executable placement in the Startup folder — persistent code execution at user privilege on every login. Confirmed leakable data includes environment variables, API keys, system prompts, concurrent users' conversation data, and proprietary code. The AI-specific risk: teams running Ollama in self-hosted or hybrid setups are often doing so specifically because they want to keep data on-premises. This vulnerability puts API keys, system prompts, and live conversation data in scope for anyone who can reach the endpoint. Immediate actions: patch to Ollama 0.17.1+, restrict network access to the instance, deploy an authentication proxy in front of the endpoint, and disable auto-updates on Windows until the signature verification flaw is patched. The deeper question: if your local LLM deployment leaks heap memory containing API keys and user conversation data, how much of your governance posture was actually on-premises? → Full CVE breakdown: http://thehackernews.com/2026/05/ollama-out-of-bounds-read-vulnerability.html → Proxy-layer protection docs: http://aisecuritygateway.ai/docs #LLMSecurity #AISecurity #AIGovernance #DataPrivacy #CyberSecurity

"Bleeding Llama" (CVE-2026-7482) es una falla crítica en el framework Ollama que permite a atacantes remotos extraer de la memoria del servidor claves API, prompts y conversaciones de usuarios mediante la carga de archivos GGUF maliciosos. Además, dos vulnerabilidades aún sin parchear en su versión para Windows (CVE-2026-42248 y CVE-2026-42249) habilitan la ejecución silenciosa y persistente de código abusando del sistema de actualizaciones.

⚠️ Using @ollama on Windows? Check your version. CVE-2026-42248 + CVE-2026-42249 (CVSS 7.7 each) Affected: 0.12.10 to 0.22.0 Patch status: UNPATCHED after 90 days of disclosure !! The patch was due yesterday, @ollama Cc. @StrigaAI @CERT_Polska

Unpatched flaws turn Ollama’s auto-updater into a persistent RCE vector, researchers say: Researchers at Striga have disclosed two vulnerabilities (CVE-2026-42248, CVE-2026-42249) in Ollama’s Windows auto-updater that, when chained together, may allow an… https://www.helpnetsecurity.com/2026/05/05/ollama-windows-vulnerabilities-cve-2026-42248-cve-2026-42249/?utm_source=dlvr.it&utm_medium=twitter https://t.co/uHil0gL95B