CVE-2026-30332 PUBLISHED

Assigner: mitre
Reserved: 04.03.2026 Published: 02.04.2026 Updated: 02.04.2026

A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:C/UI:R
CVSS Score: 7.5

Attack Vector	Local	Scope	Changed
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	n/a
Product	n/a
Versions	Version n/a is affected

References

https://github.com/balena-io/etcher/issues/4500
https://www.balena.io/security
https://github.com/B1tBreaker/CVE-2026-30332

Problem Types

n/a text