A Time‑of‑Check to Time‑of‑Use (TOCTOU) race condition exists in Balena Etcher for Windows that allows a malicious actor to replace a legitimate script with a crafted payload while the application is flashing a device. The flaw permits an attacker to execute arbitrary code with elevated privileges, constituting a severe security risk that can compromise the host operating system.

Any installation of Balena Etcher on Windows with a version earlier than v2.1.4 is affected. The vulnerability is triggered during the flashing process when scripts are validated and subsequently executed; users who specify a script to be run during the flash are at risk.

The CVSS score of 7.5 reflects a medium‑to‑high severity vulnerability. Exploit probability data (EPSS) is unavailable, and the flaw is not yet listed in the CISA KEV catalog. Based on the description, the likely attack requires local access to the target machine and the ability to run Balena Etcher with a crafted script file; no remote exploitation path is documented. The race condition between script validation and execution makes the vulnerability plausible under normal flashing scenarios.