PT-2026-29795 · Balena · Balena Etcher

B1Tbreaker · Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-30332

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AC:H/AV:L/A:H/C:H/I:H/PR:L/S:C/UI:R

Name of the Vulnerable Software and Affected Versions Balena Etcher versions prior to 2.1.4

Description A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in Balena Etcher for Windows prior to version 2.1.4. This condition allows attackers to escalate privileges and execute arbitrary code by replacing a legitimate script with a crafted payload during the flashing process.

Recommendations Update Balena Etcher to version 2.1.4 or later.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-30332

Affected Products

Balena Etcher

References · 6

• 🔥 https://github.com/B1tBreaker/CVE-2026-30332 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30332 · Security Note
• https://github.com/balena-io/etcher/issues/4500 · Note
• https://balena.io/security · Note
• https://twitter.com/CVEnew/status/2039744372032319611 · Twitter Post
• https://twitter.com/infoflowcloud/status/2039746368818876931 · Twitter Post