CVE-2026-42248

Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verification routine unconditionally returns success so no digital signature or trust validation is performed before stagin...

CVE-2026-42248

Affected product : Ollama for Windows. Vulnerabilities covered : CVE-2026-42248 (Missing signature verification for updates) and CVE-2026-42249 (Path traversal in update mechanism). Root cause : Windows update flow does not verify integrity/authenticity of downloaded update executables (CVE-2026-...