CVE-2026-30612

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 0.42%
EPSS Percentile: 34.82%
CISA KEV: Not listed

Description

An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 28-Aug-2026 03:17
Last Modified: 02-Sep-2026 03:17
EPSS Date: 2026-10-23
CWE: CWE-494

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 24-Oct-2026 11:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

Eye had disclosed the flaw, now tracked as CVE-2026-30612, in June. The U.S. Cybersecurity and Infrastructure Security Agency rates it 9.8 out of 10. It affects three versions of the Time4Popcorn software: Eye Security Sends More Than 2 Million Updates to Disable Popcorn Time Updater
The vulnerability, tracked as CVE-2026-30612, affects Windows and macOS updaters that contacted the app's abandoned domain (popcorntimeupd.xyz) over unencrypted HTTP and accepted executables without verifying digital Abandoned Time4Popcorn Updater Exposed Millions to Potential Remote Code Execution

MITRE ATT&CK (1)

Vendors (1)

Products (3)

Industries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.