PT-2026-4296 · Rufus · Rufus
Independent-Arg
·
Published
2026-01-22
·
Updated
2026-03-03
·
CVE-2026-23988
CVSS v3.1
7.3
High
| Vector | AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Rufus versions 4.11 and below
Description
Rufus, a utility for formatting and creating bootable USB flash drives, contains a time-of-check to time-of-use (TOCTOU) race condition in the
src/net.c file. This occurs during the creation, validation, and execution of the Fido PowerShell script. Because Rufus operates with elevated privileges (Administrator) but writes the script to the %TEMP% directory, which is accessible to standard users without file locking, a local attacker can replace the legitimate script with a malicious one. This allows for arbitrary code execution with Administrator privileges. The issue is exploitable when an administrator runs Rufus with elevation and a standard user has access to the same system, either locally or through Remote Desktop Protocol (RDP). This scenario allows the user to automate the file replacement in %TEMP% and gain administrator privileges.Recommendations
Rufus versions prior to 4.12 BETA should be updated.
Do not run Rufus with Administrator privileges on shared systems.
Exploit
Fix
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rufus