This vulnerability involves a TOCTOU race condition in Balena Etcher for Windows before version 2.1.4. During the disk image flashing process, an attacker can replace a legitimate script with a malicious payload between the time the script is checked and the time it is used. This allows privilege escalation and arbitrary code execution under limited user privileges. The attack vector is local with high attack complexity and requires user interaction. The vulnerability is tracked as CWE-367.

Successful exploitation can lead to privilege escalation from a limited user context to higher privileges and arbitrary code execution on the affected system. This could compromise system integrity and allow an attacker to execute malicious actions with elevated rights. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Balena Etcher's official channels for updates or patches addressing this vulnerability. Until a fix is available, avoid using vulnerable versions or limit usage to trusted environments where local privilege escalation risk is minimized.