CVE-2026-30612 in Time4Popcorn
Summary
by MITRE • 08/27/2026
An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in Time4 Popcorn across its Windows, macOS, and Android platforms represents a critical security flaw rooted in the application's software update mechanism. Specifically affecting versions up to 6.2.1.18 on Windows, 6.2.1.17 on macOS, and 3.5.0.173 on Android, this issue allows for remote code execution through compromised or maliciously crafted updater components. On the Windows platform, the vulnerability resides within the executable file named updater.exe, while on macOS systems, it is located in a component referred to as PT.updd. The core of the problem lies in how these update utilities handle input and validate sources before executing commands or installing updates, creating an avenue for attackers to inject arbitrary code that runs with the privileges of the user launching the application.
From a technical perspective, this vulnerability aligns closely with CWE-94, which describes Improper Control of Generation of Code (Code Injection). The flaw likely stems from insufficient validation of data passed to the updater processes or inadequate verification of digital signatures and source integrity during the update check process. When an attacker can manipulate the input received by these updaters, they can trick the application into executing malicious scripts or binaries instead of legitimate updates. This is particularly dangerous because update mechanisms typically operate with elevated privileges or have broad access to system resources to ensure seamless installation of new features and security patches. By exploiting this weakness, a remote attacker does not need physical access to the machine; they only require network connectivity to deliver the payload via the compromised updater channel.
The operational impact of such a vulnerability is severe, as it directly compromises the confidentiality, integrity, and availability of the affected systems. Successful exploitation allows an adversary to gain arbitrary code execution capabilities on the victim's device. This can lead to full system compromise, where the attacker installs backdoors, steals sensitive data, or uses the infected machine as part of a botnet. For users relying on Time4 Popcorn for media streaming and management, this vulnerability undermines trust in the software provider’s security practices. The existence of such flaws suggests potential weaknesses in the secure development lifecycle, particularly regarding code signing, input sanitization, and sandboxing of update processes.
In terms of industry standards mapping, this incident is also relevant to MITRE ATT&CK technique T1195, specifically Supply Chain Compromise or Exploitation for Client Execution, as it involves leveraging a trusted component (the updater) to execute malicious code. It may also relate to T1059, Command and Scripting Interpreter, if the execution involves running scripts downloaded during the update process. The vulnerability highlights the risks associated with third-party components and auto-update features that are not sufficiently isolated from the rest of the system environment.
To mitigate this risk, users should immediately upgrade Time4 Popcorn to a version later than 6.2.1.18 on Windows, 6.2.1.17 on macOS, and 3.5.0.173 on Android, assuming patched versions have been released by the vendor. If no patch is available, users are advised to disable automatic updates within the application settings if possible, or temporarily uninstall the software until a secure version is distributed. System administrators should monitor network traffic for unusual outbound connections from these updater executables and ensure that endpoint detection and response solutions are configured to alert on unexpected process executions originating from program directories typically reserved for trusted binaries. Regular auditing of installed applications and their update mechanisms remains essential for maintaining a robust security posture against supply chain attacks.