CVE-2026-30612

No known exploitation. EPSS puts it in the 36th percentile. No fix published yet.

CVSS 3.19.8Critical EPSS percentile36th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-08-27Updated 2026-09-01Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether any computer or device in your business has Time4 Popcorn installed (Windows version 6.2.1.18 or earlier, MacOS version 6.2.1.17 or earlier, or Android version 3.5.0.173 or earlier).
If found, disconnect that device's automatic updates or disable the app's update-check feature until a fix is released.
Consider uninstalling Time4 Popcorn entirely until the vendor confirms a secure version is available.
Check the vendor's website or app store listing periodically for a newer, fixed release — none has been published yet as of this writing.
If the device is used for business purposes, run a malware scan to rule out existing compromise, since this flaw has drawn sustained attention.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components

In plain language

Written by AI from the record

Time4 Popcorn media player on Windows, Mac, and Android has a flaw in its update feature that could let an attacker plant malicious code on your device, and right now there's no fix you can install.

CVE-2026-30612 is a code-without-integrity-check flaw (CWE-494) in Time4Popcorn's updater component (updater.exe on Windows, PT.updd on macOS) that lets a remote, unauthenticated attacker deliver and run arbitrary code when the app checks for updates.

If you're affected

Full device takeover
Malware or ransomware installation
Business data theft from infected device
Spread to other devices on network

What is it

Think of this app's "check for updates" feature as a delivery person who's supposed to bring you a signed, sealed package from the official software maker. This flaw means the app doesn't properly verify the package is really from them — so someone could swap in a fake, malicious delivery instead, and the app would install it without you noticing. The result could be a full takeover of whatever device runs the app.

Who is affected

This matters to you if anyone in your business uses Time4 Popcorn — on a Windows PC, a Mac, or an Android device or phone. Because the flaw lives in the app's own update mechanism, it can potentially be triggered without the user needing to click anything or log in, as long as the app is installed and can reach the internet to check for updates.

How urgent is it

There is no confirmed sign of attackers actively exploiting this flaw yet, and no public attack tool is known to exist, but the vulnerability has drawn sustained press attention and allows full remote code execution without any user action. Given the severity and lack of a fix, treat this as a real risk needing attention soon, even though it isn't an active, confirmed emergency today.

What to do — in detail

Inventory all endpoints (Windows, macOS, Android) for Time4 Popcorn and record exact version strings against the affected ranges: Windows ≤6.2.1.18, macOS ≤6.2.1.17, Android ≤3.5.0.173.
No vendor patch has been published at this time — monitor the vendor's release notes and official download page for a fixed build.
As a temporary workaround, block or restrict the update-check mechanism (updater.exe on Windows, PT.updd on macOS) from reaching the network, e.g. via firewall rule or host-based egress filtering, to prevent the malicious-update delivery path.
Consider removing the application from business-critical or internet-facing systems until a verified fixed version is confirmed.
There is no CISA KEV listing and no CISA-mandated remediation date for this CVE at this time.
Monitor vendor advisories, security news, and threat intelligence feeds for exploitation reports or a patch announcement; EPSS currently rates exploitation likelihood as low and flat, but this should be re-checked periodically given the CWE-494 download-integrity weakness and the sustained press coverage.

Technical context

CVSS 3.1 score is 9.8 (Critical: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting unauthenticated, network-exploitable, high-impact code execution with no privileges or user interaction required. The weakness is CWE-494 (Download of Code Without Integrity Check), affecting the updater components (updater.exe on Windows, PT.updd on macOS, and the Android updater logic). No public exploit code is currently known, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. EPSS places predicted exploitation likelihood at a low 0.4% (35th percentile) with a flat trend, consistent with no confirmed active exploitation. Press/pulse attention is sustained, indicating researcher/media interest, but this should not be conflated with confirmed in-the-wild exploitation. No vendor patch is currently available for any affected platform.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS36th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 36th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by wide press coverage.

Lifecycle

6 events over 5 days, from the signal feeds we watch.

2026-09-01Record updated
2026-08-31Record updated
2026-08-27Publishedweakness classified, att&ck mapped, record updated

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable