CVE-2026-23988
📋 TL;DR
This CVE describes a time-of-check to time-of-use (TOCTOU) race condition vulnerability in Rufus versions 4.11 and below. When Rufus runs with Administrator privileges to create a PowerShell script, a local attacker can replace the legitimate script with a malicious one before execution, leading to arbitrary code execution with elevated privileges. Users running vulnerable Rufus versions on Windows systems are affected.
💻 Affected Systems
- Rufus
📦 What is this software?
Rufus by Akeo
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with Administrator privileges, allowing attacker to install persistent malware, steal credentials, or disable security controls.
Likely Case
Local privilege escalation where a standard user gains Administrator access to execute arbitrary code on the system.
If Mitigated
No impact if Rufus is not used or if patched version is installed.
🎯 Exploit Status
Exploitation requires local access and precise timing to win the race condition. The attacker needs to be able to write to the %TEMP% directory as a standard user.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.12_BETA
Vendor Advisory: https://github.com/pbatard/rufus/security/advisories/GHSA-hcx5-hrhj-xhq9
Restart Required: No
Instructions:
1. Download Rufus 4.12_BETA or later from the official GitHub releases page. 2. Uninstall the old version. 3. Install the new version. 4. Verify the version is 4.12_BETA or higher.
🔧 Temporary Workarounds
Disable Fido PowerShell script functionality
windowsPrevent Rufus from creating the vulnerable PowerShell script by disabling Fido integration
Not applicable - disable via Rufus GUI settings
Run Rufus without Administrator privileges
windowsRun Rufus as a standard user to prevent privilege escalation
Right-click Rufus executable > Run as standard user
🧯 If You Can't Patch
- Restrict standard user write access to %TEMP% directory for Rufus processes
- Monitor for suspicious PowerShell script creation/modification in %TEMP% directory
🔍 How to Verify
Check if Vulnerable:
Check Rufus version in Help > About. If version is 4.11 or below, the system is vulnerable.Check Version:
rufus.exe --version (or check Help > About in GUI)Verify Fix Applied:
Verify Rufus version is 4.12_BETA or higher in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unusual PowerShell script execution from %TEMP% directory with Administrator privileges
- Multiple rapid file modifications in %TEMP% directory during Rufus execution
Network Indicators:
- None - this is a local attack
SIEM Query:
EventID=4688 AND ProcessName='powershell.exe' AND CommandLine LIKE '%TEMP%' AND IntegrityLevel='High'