EUVD-2026-67256
GHSA-4j2w-5xm5-97rj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-494 update-hijack RCE needs a MITM/update-server position, so AC:H rather than AC:L; updater runs automatically (UI:N) and payload gains full code execution (C/I/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components
AnalysisAI
Remote code execution in Time4Popcorn - a Popcorn Time media-streaming fork - affects the Windows client (<= 6.2.1.18), macOS client (<= 6.2.1.17), and Android client (<= 3.5.0.173) through the application's auto-update mechanism (updater.exe on Windows, the PT.updd component on macOS). Because the updater fetches and executes update payloads without verifying their integrity (CWE-494), an attacker able to influence the update channel can deliver and run arbitrary code on the victim host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to control or intercept the software update channel used by Time4Popcorn's updater.exe (Windows), PT.updd (macOS), or the Android update path - i.e., a machine-in-the-middle position on the victim's network or control of the update server - and the victim must be running an affected build (Windows <= 6.2.1.18, macOS <= 6.2.1.17, Android <= 3.5.0.173) that performs an update check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) treats this as trivially exploitable over the network against default installs, but that rating is in tension with the CWE-494 root cause: insecure-updater RCE almost always requires the attacker to occupy the update path - either a machine-in-the-middle position on the update channel or control of the update server - which is a real prerequisite rather than a low-complexity network shot. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version is identified at time of analysis, and no version above the affected ranges is confirmed in the input data, so upgrade guidance cannot cite a specific fixed build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify any presence of Time4Popcorn on organizational or employee devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-494 – Download of Code Without Integrity Check
View allShare
External POC / Exploit Code
Leaving vuln.today