pbatard rufus up to 4.11/4.12 src/net.c toctou

Summaryinfo

A vulnerability has been found in pbatard rufus up to 4.11/4.12 and classified as critical. This impacts an unknown function of the file src/net.c. The manipulation leads to toctou. This vulnerability is uniquely identified as CVE-2026-23988. Local access is required to approach this attack. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in pbatard rufus up to 4.11/4.12 and classified as critical. This issue affects an unknown part of the file src/net.c. The manipulation with an unknown input leads to a toctou vulnerability. Using CWE to declare the problem leads to CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Rufus is a utility that helps format and create bootable USB flash drives. Versions 4.11 and below contain a race condition (TOCTOU) in src/net.c during the creation, validation, and execution of the Fido PowerShell script. Since Rufus runs with elevated privileges (Administrator) but writes the script to the %TEMP% directory (writeable by standard users) without locking the file, a local attacker can replace the legitimate script with a malicious one between the file write operation and the execution step. This allows arbitrary code execution with Administrator privileges. This issue has been fixed in version 4.12_BETA.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-23988 since 01/19/2026. The exploitation is known to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.12_BETA eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 460cc5768aa45be07941b9e4ebc9bee02d282873 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-4202). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• pbatard

Name

• rufus

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12

License

• open-source

Website

• Product: https://github.com/pbatard/rufus/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion