CVE-2026-42249Disclosure(microsoft / ollama)

> run Claude Code root-level on your computer > paste in the following prompt: Audit my MacBook for exposure to the Ollama vulnerabilities disclosed on May 10, 2026 (CVE-2026-7482 "Bleeding Llama" — heap out-of-bounds read in GGUF loader on `/api/create`, fixed in 0.17.1; and CVE-2026-42248 / CVE-2026-42249 — Windows-only updater flaws affecting 0.12.10–0.22.0, can be skipped since this is macOS but confirm no Windows VM/Parallels instance is running Ollama) and produce a single concise final report — do not fix anything, only diagnose. Specifically: (1) check if Ollama is installed and get its version with `ollama --version` and `which ollama`, then compare against 0.17.1 to determine if the GGUF flaw applies; (2) determine whether the Ollama server is currently running and on what interface — run `lsof -nP -iTCP:11434 -sTCP:LISTEN` and `ps aux | grep -i ollama` to see if it's bound to `127.0.0.1` (safe, loopback only) or `0.0.0.0`/`*` (listening on all interfaces, network-reachable); (3) check the launch environment for `OLLAMA_HOST` — inspect `launchctl getenv OLLAMA_HOST`, `~/.zshrc`, `~/.zprofile`, `~/.bash_profile`, `~/.bashrc`, and any LaunchAgents/LaunchDaemons under `~/Library/LaunchAgents` and `/Library/LaunchAgents` for persistent `OLLAMA_HOST=0.0.0.0` settings; (4) determine the local network exposure layer — get the LAN IP with `ifconfig | grep "inet "`, check the macOS application firewall state with `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate` and whether Ollama is allowed/blocked, and note that even if bound to `0.0.0.0` the box is only LAN-reachable unless the upstream router forwards port 11434 (which the agent cannot verify from inside the host — flag this as a manual check); (5) check for any reverse proxy, Tailscale, ngrok, Cloudflare Tunnel, or similar tunneling tool that could expose 11434 publicly — run `ps aux | grep -E "ngrok|cloudflared|tailscaled|frp"` and `ls ~/Library/LaunchAgents`; (6) confirm no Windows Ollama instance is running in a Parallels/VMware/UTM VM by listing running VMs if any virtualization software is installed. Then output one short final report with: Ollama version + vulnerable yes/no, listening interface (loopback vs all), `OLLAMA_HOST` env state, LAN IP, tunneling tools detected, and a one-line verdict — "likely affected", "only-if-router-forwards-11434", or "not affected" — plus the single most important action to take. Do not modify any files, do not stop or start Ollama, do not change firewall rules.

We reported CVE-2026-42248 and CVE-2026-42249 to @ollama on January 27. It is still unpatched. Read write-up on our findings here -> https://www.striga.ai/research/ollama-windows-auto-update-rce

Persistent RCE in @ollama's Windows auto-updater. An HTTP header decides where the downloaded file lands on disk. The signature check that would catch this is one line: return nil. Windows runs the dropped binary every login. CVE-2026-42248 + CVE-2026-42249. Affected: 0.12.10 - 0.22.0. Still unpatched after the 90-day disclosure window. Thanks to @CERT_Polska for picking up coordination with the vendor unresponsive. https://striga.ai/research/ollama-windows-auto-update-rce

@Dinosn Regarding Ollama, here is our article in which we explain our findings covered in THN article (CVE-2026-42248, CVE-2026-42249). We reported those in Jan, 2026, and the newest release is still unpatched. https://www.striga.ai/research/ollama-windows-auto-update-rce

CVE-2026-42249 Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When … https://www.cve.org/CVERecord?id=CVE-2026-42249

🚨 Cyber Spotlight: CVE-2026-42249 – Ollama Update Path Traversal Bug A newly identified vulnerability in the Ollama update process could allow path traversal exploitation, potentially enabling attackers to access or manipulate sensitive files outside intended directories. In this episode, we break down: 🔍 What the vulnerability is ⚠️ How it could impact your business 🛡️ What steps you should take to reduce risk 📌 How to respond effectively and stay protected Understanding vulnerabilities like this is critical for maintaining a strong security posture in today’s threat landscape. 👉 Follow us for more cybersecurity insights. https://hubs.li/Q04mFSb50 🌐 Visit our website for CVE blogs, threat updates, and security resources #CyberSecurity #InfoSec #CVE #Vulnerability #Ollama #PathTraversal #ApplicationSecurity #CyberAwareness #ThreatIntel #SecurityUpdate #IncidentResponse #DevSecOps #CloudSecurity #SoftwareSecurity #CyberDefense #PatchManagement #HackingPrevention #SecurityFirst #TechAwareness #CyberSpotlight

CVE-2026-42249: Ollama Update Path Traversal Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04gcL110

CVE-2026-7482 "Bleeding Llama" — CVSS 9.1, unauthenticated remote attack, 300,000+ exposed Ollama servers. This one has a data-specific impact that deserves attention beyond the patch advisory. The exploit chain is three steps: upload a malformed GGUF via HTTP POST, trigger the read through the /api/create endpoint, exfiltrate the heap contents via /api/push. No authentication required." The vulnerability sits in Ollama's GGUF model loader. A crafted file with inflated tensor offset values causes the server to read beyond allocated heap boundaries — and what's in that heap is the problem. Separate Windows flaws compound this. CVE-2026-42248 and CVE-2026-42249 (both CVSS 7.7, currently unpatched) combine missing update binary signature verification with a path traversal that allows arbitrary executable placement in the Startup folder — persistent code execution at user privilege on every login. Confirmed leakable data includes environment variables, API keys, system prompts, concurrent users' conversation data, and proprietary code. The AI-specific risk: teams running Ollama in self-hosted or hybrid setups are often doing so specifically because they want to keep data on-premises. This vulnerability puts API keys, system prompts, and live conversation data in scope for anyone who can reach the endpoint. Immediate actions: patch to Ollama 0.17.1+, restrict network access to the instance, deploy an authentication proxy in front of the endpoint, and disable auto-updates on Windows until the signature verification flaw is patched. The deeper question: if your local LLM deployment leaks heap memory containing API keys and user conversation data, how much of your governance posture was actually on-premises? → Full CVE breakdown: http://thehackernews.com/2026/05/ollama-out-of-bounds-read-vulnerability.html → Proxy-layer protection docs: http://aisecuritygateway.ai/docs #LLMSecurity #AISecurity #AIGovernance #DataPrivacy #CyberSecurity

"Bleeding Llama" (CVE-2026-7482) es una falla crítica en el framework Ollama que permite a atacantes remotos extraer de la memoria del servidor claves API, prompts y conversaciones de usuarios mediante la carga de archivos GGUF maliciosos. Además, dos vulnerabilidades aún sin parchear en su versión para Windows (CVE-2026-42248 y CVE-2026-42249) habilitan la ejecución silenciosa y persistente de código abusando del sistema de actualizaciones.

⚠️ Using @ollama on Windows? Check your version. CVE-2026-42248 + CVE-2026-42249 (CVSS 7.7 each) Affected: 0.12.10 to 0.22.0 Patch status: UNPATCHED after 90 days of disclosure !! The patch was due yesterday, @ollama Cc. @StrigaAI @CERT_Polska

Unpatched flaws turn Ollama’s auto-updater into a persistent RCE vector, researchers say: Researchers at Striga have disclosed two vulnerabilities (CVE-2026-42248, CVE-2026-42249) in Ollama’s Windows auto-updater that, when chained together, may allow an… https://www.helpnetsecurity.com/2026/05/05/ollama-windows-vulnerabilities-cve-2026-42248-cve-2026-42249/?utm_source=dlvr.it&utm_medium=twitter https://t.co/uHil0gL95B