CVE-2026-30332

Published: Apr 2, 2026Modified: Jul 24, 2026

7.5

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 6.0

Source: MITRE (Secondary)

Description

A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process.

Related CWEs

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

References (3)

https://github.com/B1tBreaker/CVE-2026-30332

Source: cve@mitre.org

https://github.com/balena-io/etcher/issues/4500

Source: cve@mitre.org

https://www.balena.io/security

Source: cve@mitre.org

Timeline

No history available yet.