Security readout for executives and security teams
Plain-English summary
CVE-2026-23988 is a local privilege escalation flaw in Rufus, a Windows bootable USB creation tool. A standard local user could potentially abuse how Rufus handles a temporary Fido PowerShell script to run code as Administrator. This requires local access and user interaction, but impact is high if Rufus is used on shared or managed Windows systems.
Executive priority
Prioritize remediation where Rufus is used by IT staff, on shared Windows systems, or in endpoint build workflows. This is not currently reported as actively exploited in the provided sources, but the administrator-level impact makes timely cleanup and version control appropriate.
Technical view
Rufus versions 4.11 and below have a TOCTOU race condition in src/net.c during creation, validation, and execution of the Fido PowerShell script. Rufus runs elevated but writes the script under %TEMP%, which standard users can modify, without locking it. Replacement before execution can lead to arbitrary code execution with Administrator privileges. Fixed in 4.12_BETA.
Likely exposure
Exposure is limited to Windows systems where Rufus 4.11 or earlier is present and can be run with Administrator privileges. Risk is higher on shared workstations, IT build machines, helpdesk systems, or environments where non-admin users can influence temporary files while an administrator runs Rufus.
Exploitation context
The CVSS vector indicates local access, low attack complexity, low privileges, and required user interaction. The source bundle does not cite active exploitation, and KEV status is false. This is not a remote attack path; it is a local escalation opportunity after some access already exists.
Researcher notes
The issue is CWE-367, a time-of-check/time-of-use race in Fido script handling. Public sources identify the vulnerable area and fixing commit, but this assessment avoids exploit timing details. Validate exposure through version and usage context rather than attempting reproduction on production systems.
Mitigation direction
- Upgrade Rufus to version 4.12_BETA or follow newer vendor guidance if available.
- Remove or restrict Rufus 4.11 and earlier from managed endpoints.
- Limit Rufus execution to trusted administrator workflows and controlled workstations.
- Monitor vendor advisory and release notes for a stable fixed release.
Validation and detection
- Inventory endpoints for installed or portable Rufus copies.
- Confirm any Rufus version found is later than 4.11 or the fixed 4.12_BETA.
- Review software distribution shares and technician toolkits for older Rufus binaries.
- Check whether Rufus is used on shared systems or by helpdesk administrators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-367: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-23988 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H1.35.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/pbatard/rufus/security/advisories/GHSA-hcx5-hrhj-xhq9CVE reference · x_refsource_CONFIRM
- https://github.com/pbatard/rufus/commit/460cc5768aa45be07941b9e4ebc9bee02d282873CVE reference · x_refsource_MISC
- https://github.com/pbatard/rufus/releases/tag/v4.12_BETACVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check Time-of-use (TOCTOU) Race Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.