CVE-2026-23988

Deeper analysis

CVE-2026-23988 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability, classified under CWE-367, affecting Rufus versions 4.11 and earlier. Rufus is a utility for formatting and creating bootable USB flash drives. The issue resides in the src/net.c component during the creation, validation, and execution of the Fido PowerShell script. With a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), the vulnerability arises because Rufus runs with elevated Administrator privileges but writes the script to the %TEMP% directory, which is writable by standard users, without properly locking the file.

A local attacker with low privileges can exploit this by replacing the legitimate PowerShell script with a malicious one in the %TEMP% directory between the write and execution steps, as Rufus does not prevent concurrent access. This requires the victim to run Rufus as Administrator, introducing a user interaction element. Successful exploitation enables arbitrary code execution with Administrator privileges, potentially leading to full system compromise.

The vulnerability has been addressed in Rufus version 4.12_BETA, as detailed in the project's GitHub security advisory (GHSA-hcx5-hrhj-xhq9), release notes, and the fixing commit (460cc5768aa45be07941b9e4ebc9bee02d282873). Security practitioners should advise users to update to 4.12_BETA or later and avoid running Rufus from untrusted environments.