Balena Etcher Windows TOCTOU Privilege Escalation — CVE-2026-30332

Metadata

Affected Target

Summary

Balena Etcher for Windows writes a temporary .cmd script (containing environment variables and the command to launch etcher-util.exe) to a user-writable temp directory and then executes it with elevated privileges via a UAC prompt. Because there is a time gap between the file being created and being executed, and Etcher performs no integrity check on the script before running it, a medium-integrity process monitoring the same directory can overwrite the .cmd file with malicious commands in that window. Once the user accepts the UAC prompt, the attacker’s injected commands run with high-integrity/elevated privileges — in this PoC, creating and elevating a new local administrator account.

Vulnerability Details

Root Cause

Time-of-check to time-of-use (TOCTOU) race condition: Etcher creates a .cmd launcher script in a user-writable temp folder (%LOCALAPPDATA%\Temp\etcher\) and later executes it elevated via UAC without validating its integrity/contents at execution time.

Attack Vector

1. Attacker (as a normal, medium-integrity user) runs a monitoring script that watches %LOCALAPPDATA%\Temp\etcher\ for files matching balena-etcher-electron-*.cmd.
2. Victim launches Balena Etcher, selects an image and target device, and clicks “Flash,” which causes Etcher to write the temporary .cmd launcher.
3. The monitoring script detects the new .cmd file and immediately overwrites it, appending malicious commands (e.g. net user/net localgroup administrators to create a new admin account) before the legitimate etcher-util.exe invocation.
4. Victim accepts the resulting UAC elevation prompt, believing it to be from Etcher; the tampered script executes with high integrity, running the attacker’s injected commands as well as the original Etcher utility.

Impact

A medium-integrity local process/user can escalate to a high-integrity/administrator context by hijacking the elevation Etcher itself requests, including creating a new local administrator account.

Environment / Lab Setup

Target:   Balena Etcher for Windows < 2.1.4
Attacker: Python 3 (glob/os/time), local Windows user session

Proof of Concept

PoC Script

See exploit.py in this folder.

1
2

python exploit.py
:: then launch Balena Etcher, select an image/device, click Flash, and accept the UAC prompt

The script polls the Etcher temp directory for newly created .cmd launcher files and, once detected, overwrites them with a payload that creates a new local administrator account (exploitUser) before the original elevated command runs.

Detection & Indicators of Compromise

Signs of compromise:

• New unexpected local administrator accounts (e.g. exploitUser) appearing after using Etcher
• File modification timestamps on %LOCALAPPDATA%\Temp\etcher\*.cmd inconsistent with Etcher’s own process activity
• A background/monitoring process with a handle open on the Etcher temp directory

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/B1tBreaker/CVE-2026-30332 on 2026-07-05.