A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and ex…

A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability affects Balena Etcher for Windows versions prior to v2.1.4. The vulnerability allows attackers to escalate privileges and execute arbitrary code by replacing legitimate scripts with malicious payloads during the flashing process. This represents a significant security risk as it can lead to complete system compromise. The vulnerability has been assigned CVE-2026-30332 and affects a popular disk imaging utility. Users should update to version 2.1.4 or later to mitigate this risk.