A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute a…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com
• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 2, 2026 · NIST NVD

   Detected

   A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process.

2. Jul 24, 2026 · NIST NVD

   Updated

   A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process.

Sources

• CVE.orgVulnerability recordCVE-2026-30332

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-30332

  A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process.

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · balena.io