CVE-2026-30612
Remote code execution via vulnerable updater in Time4Popcorn
The flaw is in the updater of Time4Popcorn, an abandoned fork of Popcorn Time. It used unencrypted HTTP connections and lacked digital signature verification, allowing a remote attacker to execute arbitrary code with elevated privileges. The vulnerability affects Windows, MacOS, and Android versions listed, but security researchers have remotely disabled the dangerous updater.
n/a · Updated 28 Oct · From 1 of our story and the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 9.8 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- No fix is available from Time4Popcorn. Security researchers have remotely disabled the vulnerable updater, so users should verify that their installation no longer uses it.
- If unsure, uninstall the Time4Popcorn application to eliminate any risk.
What happened
- 23 OctSecurity researchers remotely disabled the vulnerable updater in the abandoned Time4Popcorn application, closing the remote code execution risk on millions of devices.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-30612 | An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to e… | critical 9.8 | No | 0.4% |
Our reporting
23 OctResearchers disable vulnerable updater in abandoned Popcorn Time fork, closing RCE risk on millions of devicesThe records
CVE-2026-30612 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works