{"id":"CVE-2026-30332","details":"A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process.","modified":"2026-10-28T02:31:09.472795800Z","published":"2026-04-02T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30332.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://www.balena.io/security"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30332.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30332"},{"type":"REPORT","url":"https://github.com/balena-io/etcher/issues/4500"},{"type":"PACKAGE","url":"https://github.com/B1tBreaker/CVE-2026-30332"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/balena-io/etcher","events":[{"introduced":"0"},{"fixed":"a79db1db6b940dbc4616df2d760cb25a81c1133f"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"2.1.4"}],"source":"DESCRIPTION"}]}}],"versions":["v2.1.3","v2.1.2","v2.1.1","v2.1.0","v2.0.0","v1.19.25","v1.19.24","v1.19.23","v1.19.22","v1.19.21","v1.19.20","v1.19.19","v1.19.18","v1.19.17","v1.19.16","v1.19.15","v1.19.14","v1.19.13","v1.19.12","v1.19.11","v1.19.10","v1.19.9","v1.19.8","v1.19.7","v1.19.6","v1.19.5","v1.19.4","v1.19.3","v1.19.2","v1.19.1","v1.19.0","v1.18.14","v1.18.13","v1.18.12","v1.18.11","v1.18.10","v1.18.9","v1.18.8","v1.18.7","v1.18.6","v1.18.5","v1.18.4","v1.18.3","fix-accept-encoding-gzip","v1.18.2","v1.18.1","v1.18.0","v1.17.0","v1.16.0","v1.15.6","v1.15.5","tags/v1.15.5","v1.15.4","v1.15.3","v1.15.2","v1.15.1","v1.15.0","v1.14.3","v1.14.2","v1.14.1","v1.14.0","v1.13.4","v1.13.3","v1.13.2","v1.13.1","v1.13.0","v1.12.7","v1.12.6","v1.12.5","v1.12.4","v1.12.3","v1.12.2","v1.12.1","v1.12.0","v1.11.10","v1.11.9","v1.11.8","v1.11.7","v1.11.6","v1.11.5","v1.11.4","v1.11.3","v1.11.2","v1.11.1","v1.11.0","v1.10.29","v1.10.28","v1.10.27","v1.10.26","v1.10.25","v1.10.24","v1.10.23","v1.10.22","v1.10.21","v1.10.20","v1.10.19","v1.10.18","v1.10.17","v1.10.16","v1.10.15","v1.10.14","v1.10.13","v1.10.12","v1.10.11","v1.10.10","v1.10.9","v1.10.8","v1.10.7","v1.10.6","v1.10.5","v1.10.4","v1.10.3","v1.10.2","v1.10.1","v1.10.0","v1.9.0","v1.8.17","v1.8.16","v1.8.15","v1.8.14","v1.8.13","v1.8.12","v1.8.11","v1.8.10","v1.8.9","v1.8.8","v1.8.7","v1.8.6","v1.8.5","v1.8.4","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.7.15","v1.7.9","v1.7.14","v1.7.13","v1.7.12","v1.7.11","v1.7.10","v1.5.122","v1.7.8","v1.7.7","v1.7.6","v1.7.5","v1.7.4","v1.7.3","v1.7.2","v1.7.1","v1.7.0","v1.5.112","v1.6.0","v1.5.121","v1.5.120","v1.5.119","v1.5.118","v1.5.117","v1.5.116","v1.5.115","v1.5.114","v1.5.113","v1.5.111","v1.5.110","v1.5.109","v1.5.108","v1.5.107","v1.5.106","v1.5.105","v1.5.104","v1.5.103","v1.5.102","v1.5.101","v1.5.100","v1.5.99","v1.5.98","v1.5.97","v1.5.96","v1.5.95","v1.5.94","v1.5.93","v1.5.92","v1.5.91","v1.5.90","v1.5.89","v1.5.88","v1.5.87","v1.5.86","v1.5.84","v1.5.83","v1.5.82","v1.5.81","v1.5.80","v1.5.79","v1.5.78","v1.5.77","v1.5.76","v1.5.75","v1.5.74","v1.5.73","v1.5.72","v1.5.71","v1.5.70","v1.5.69","v1.5.68","v1.5.67","v1.5.66","v1.5.65","v1.5.64","v1.5.63","v1.5.62","v1.5.61","v1.5.60","v1.5.59","v1.5.58","v1.5.57","v1.5.56","v1.5.55","v1.5.54","v1.5.53","v1.5.52","v1.5.51","v1.5.50","v1.5.49","v1.5.48","v1.5.47","v1.5.46","v1.5.45","v1.5.44","v1.5.43","v1.5.42","v1.5.41","v1.5.40","v1.5.39","v1.5.38","v1.5.37","v1.5.36","v1.5.35","v1.5.34","v1.5.33","v1.5.32","v1.5.31","v1.5.30","v1.5.29","v1.5.28","v1.5.27","v1.5.26","v1.5.25","v1.5.24","v1.5.23","v1.5.22","v1.5.21","v1.5.20","v1.5.19","v1.5.18","v1.5.17","v1.5.16","v1.5.15","v1.5.14","v1.5.13","v1.5.12","v1.4.9","v1.5.11","v1.5.10","v1.5.9","v1.5.8","v1.5.7","v1.5.6","v1.5.5","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.4.8","v1.4.7","v1.4.6","v1.4.5","v1.4.4","v1.4.3","v1.4.2","v1.4.1","v1.3.1","v1.3.0","v1.2.1","v1.1.2","v1.1.1","v1.1.0","v1.0.0","v1.0.0-rc.5","v1.0.0-rc.4","v1.0.0-rc.3","v1.0.0-rc.2","v1.0.0-rc.1","v1.0.0-beta.19","v1.0.0-beta.18","v1.0.0-beta.17","v1.0.0-beta.16","v1.0.0-beta.15","v1.0.0-beta.14","v1.0.0-beta.13","v1.0.0-beta.12","v1.0.0-beta.11","v1.0.0-beta.10","v1.0.0-beta.9","v1.0.0-beta.8","v1.0.0-beta.7","v1.0.0-beta.6","v1.0.0-beta.5","v1.0.0-beta.4","v1.0.0-beta.3","v1.0.0-beta.2","v1.0.0-beta.1","v1.0.0-beta.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30332.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:C/UI:R"}]}