CVE-2026-30332

high

Description

A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process.

References

https://www.balena.io/security

https://github.com/balena-io/etcher/issues/4500

https://github.com/B1tBreaker/CVE-2026-30332

Details

Source: Mitre, NVD

Published: 2026-04-02

Updated: 2026-04-03

Risk Information

CVSS v2

Base Score: 6

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00011