Executive brief
Balena Etcher is a popular tool used to write operating system images to SD cards and USB drives. A security flaw in the Windows version allows a malicious program already on a user's computer to intercept the tool's internal processes. If successful, an attacker can gain full administrative control over the computer, potentially leading to data theft or the installation of persistent malware.
Technical details
A TOCTOU race condition exists in Balena Etcher for Windows prior to v2.1.4. When a user initiates a flash, the application creates a temporary .cmd file in a user-writable directory (AppData\Local\Temp\etcher) and subsequently executes it with elevated privileges via UAC. An attacker with local medium-integrity access can monitor this directory and replace the script with a malicious payload in the window between file creation and execution. This allows for arbitrary code execution with high integrity (administrative privileges). The issue is addressed in version 2.1.4.
Affected products
- Balena Etcher prior to v2.1.4
Timeline
- 2025-05-12: disclosed: Vulnerability reported to Balena by Vasileios Flengas
- 2025-07-29: patched: Resolution date listed by vendor
- 2026-04-02: advisory: CVE published to NVD