Time4Popcorn CVE-2026-30612

Exploitation requires the attacker to control or intercept the software update channel used by Time4Popcorn's updater.exe (Windows), PT.updd (macOS), or the Android update path - i.e., a machine-in-the-middle position on the victim's network or control of the update server - and the victim must be running an affected build (Windows <= 6.2.1.18, macOS <= 6.2.1.17, Android <= 3.5.0.173) that performs an update check. What limits exploitation: the attacker cannot exploit this from an arbitrary remote location without update-path access, so it is not exploitable against a host that never performs an update or whose update traffic cannot be tampered with; despite the CVSS AC:L/UI:N metrics, the CWE-494 nature makes an interception/hijack position a real precondition.

The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) treats this as trivially exploitable over the network against default installs, but that rating is in tension with the CWE-494 root cause: insecure-updater RCE almost always requires the attacker to occupy the update path - either a machine-in-the-middle position on the update channel or control of the update server - which is a real prerequisite rather than a low-complexity network shot. This makes the practical attack complexity higher than AC:L implies. Weighed against low EPSS (0.26%, 18th percentile), no KEV entry, and no identified public exploit, the realistic priority is moderate rather than critical-emergency: the impact is genuine full code execution, but exploitation is conditional on adversary network positioning and is not automatable at scale. Any operator or IT team running Time4Popcorn on managed endpoints should still prioritize removing or updating it, since a successful update-hijack yields full host compromise; the elevated CVSS should be interpreted as worst-case impact, not confirmed ease of exploitation.

A user on an untrusted or attacker-controlled network (public Wi-Fi, compromised router, or hostile ISP path) runs Time4Popcorn, which triggers an automatic update check. The attacker, positioned to intercept or spoof the update response, returns a malicious payload that updater.exe (or PT.updd on macOS) installs and executes without integrity verification, resulting in arbitrary code execution under the user's account. No public proof-of-concept is identified at time of analysis.