CVE-2026-30612: n/a

This vulnerability in Time4 Popcorn affects multiple platforms and involves insecure handling of the updater components, specifically updater.exe on Windows and PT.updd on MacOS. An attacker can exploit this flaw remotely without privileges or user interaction to execute arbitrary code. The CVE is associated with CWE-494 (Download of Code Without Integrity Check), indicating a failure to verify the integrity of downloaded code, leading to potential code injection or execution attacks. No official remediation or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the affected application, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected systems. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the updater components if possible and monitor for updates from the vendor. Avoid running the affected software in high-risk environments.