{"id":"CVE-2026-23988","summary":"Rufus has Local Privilege Escalation via TOCTOU Race Condition in Fido Script Handling","details":"Rufus is a utility that helps format and create bootable USB flash drives. Versions 4.11 and below contain a race condition (TOCTOU) in src/net.c during the creation, validation, and execution of the Fido PowerShell script. Since Rufus runs with elevated privileges (Administrator) but writes the script to the %TEMP% directory (writeable by standard users) without locking the file, a local attacker can replace the legitimate script with a malicious one between the file write operation and the execution step. This allows arbitrary code execution with Administrator privileges. This issue has been fixed in version 4.12_BETA.","aliases":["GHSA-hcx5-hrhj-xhq9"],"modified":"2026-08-12T03:51:32.922828512Z","published":"2026-01-22T21:52:26.925Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23988.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-367"]},"references":[{"type":"WEB","url":"https://github.com/pbatard/rufus/releases/tag/v4.12_BETA"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23988.json"},{"type":"ADVISORY","url":"https://github.com/pbatard/rufus/security/advisories/GHSA-hcx5-hrhj-xhq9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23988"},{"type":"FIX","url":"https://github.com/pbatard/rufus/commit/460cc5768aa45be07941b9e4ebc9bee02d282873"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pbatard/rufus","events":[{"introduced":"0"},{"fixed":"cac828621acd8b6e446f2e256ecd6ae90fc103a3"},{"fixed":"460cc5768aa45be07941b9e4ebc9bee02d282873"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:akeo:rufus:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.12"}]}}],"versions":["\u003c 4.12_BETA","v4.12_BETA","v4.11","v4.10","v4.9","v4.8","v4.7","v4.6","v4.5","v4.4","v4.3","v4.2","v4.1","v4.0","v3.22","v3.21","v3.20","v3.19","v3.18","v3.17","v3.16","v3.15","v3.14","v3.13","v3.12","v3.11","v3.10","v3.9","v3.8","v3.7","v3.6","v3.5","v3.4","v3.3","v3.2","v3.1","v3.0","v2.18","v2.17","v2.16","v2.15","v2.14","v2.13","v2.12","v2.11","v2.10","v2.9","v2.8","v2.7","v2.6","v2.5","v2.4","v2.3","v2.2","v2.1","v2.0","v1.4.12","v1.4.11","v1.4.10","v1.4.9","v1.4.8","v1.4.7","v1.4.6","v1.4.5","v1.4.4","v1.4.3","v1.4.2","v1.4.1","v1.4.0","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.7","v1.1.6","v1.1.5","v1.1.4","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23988.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}