What’s Vulnerable › Vulnerabilities

CVE-2026-23988: Rufus has Local Privilege Escalation via TOCTOU Race Condition in Fido Script Handling

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-22 · updated 2026-06-17
• Weakness: CWE-367

Description

Rufus is a utility that helps format and create bootable USB flash drives. Versions 4.11 and below contain a race condition (TOCTOU) in src/net.c during the creation, validation, and execution of the Fido PowerShell script. Since Rufus runs with elevated privileges (Administrator) but writes the script to the %TEMP% directory (writeable by standard users) without locking the file, a local attacker can replace the legitimate script with a malicious one between the file write operation and the execution step. This allows arbitrary code execution with Administrator privileges. This issue has been fixed in version 4.12_BETA.

Affected products

• Akeo Consulting Rufus: before 4.12 — fixed in 4.12

How to fix

Upgrade to a fixed version: Akeo Consulting Rufus 4.12. Check the vendor advisory for mitigations.

References

• https://github.com/pbatard/rufus/commit/460cc5768aa45be07941b9e4ebc9bee02d282873
• https://github.com/pbatard/rufus/releases/tag/v4.12_BETA
• https://github.com/pbatard/rufus/security/advisories/GHSA-hcx5-hrhj-xhq9

Get alerted when CVE-2026-23988 or the next vulnerability affects your stack