A time‑of‑check to time‑of‑use (TOCTOU) race condition exists in the Fido PowerShell script handling routine within Rufus. The program writes the script to the user’s %TEMP% directory while running with elevated Administrator privileges, but does not lock the file. A local user with write access to that directory can replace the script before Rufus executes it, allowing the attacker to run arbitrary code as Administrator. This flaw permits privilege escalation and code execution without any network involvement.

The vulnerability affects the Rufus utility developed by pbatard. Versions 4.11 and earlier are impacted. A patch is available in Rufus version 4.12_BETA and later.

The CVSS score of 7.3 signifies a high severity rating. The EPSS score of less than 1% indicates a very low probability of exploitation under current public data, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires a local attacker who can run Rufus with administrator privileges on the target machine. Because the flaw occurs during script creation and execution on the local filesystem, it is not remotely exploitable but can be triggered by anyone with physical access or terminal access to the device.