PatchSiren cyber security CVE debrief

CVE-2026-30612 Time4 Popcorn CVE debrief

The CVE-2026-30612 vulnerability affects Time4 Popcorn software versions <= 6.2.1.18 for Windows, <= 6.2.1.17 for MacOS, and <= 3.5.0.173 for Android, allowing remote attackers to execute arbitrary code via the updater.exe for Windows and PT.updd on MacOS components. This critical vulnerability has a CVSS score of 9.8 and is classified as CRITICAL. Administrators and users of affected software versions should take immediate action to patch or mitigate the vulnerability. Evidence from official CVE and NVD sources indicates a critical vulnerability in Time4 Popcorn for Windows, MacOS, and Android. Details on affected versions and patches are limited, and defenders should verify the information with the vendor or other trusted sources.

Vendor: Time4 Popcorn
Product: Time4 Popcorn
CVSS: CRITICAL 9.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-08-27
Original CVE updated: 2026-09-01
Advisory published: 2026-08-27
Advisory updated: 2026-09-01

Who should care

Administrators and users of Time4 Popcorn software, particularly those with versions <= 6.2.1.18 for Windows, <= 6.2.1.17 for MacOS, and <= 3.5.0.173 for Android, should take immediate action to patch or mitigate the vulnerability. This includes reviewing and verifying all instances of the software, monitoring for suspicious activity, and applying patches or updates from the vendor as soon as possible.

Technical summary

A critical vulnerability in Time4 Popcorn software allows remote attackers to execute arbitrary code via the updater.exe for Windows and PT.updd on MacOS components. The vulnerability affects Time4 Popcorn for Windows <= 6.2.1.18, Time4Popcorn for MacOS <= 6.2.1.17, and Time4Popcorn for Android <= 3.5.0.173. This vulnerability has a CVSS score of 9.8 and is classified as CRITICAL.

Defensive priority

Critical vulnerability in Time4 Popcorn software allows remote code execution; immediate patching recommended.

Recommended defensive actions

Apply patches or updates from the vendor immediately
Inventory and verify all instances of Time4 Popcorn software
Monitor for suspicious activity related to the software
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from official CVE and NVD sources indicates a critical vulnerability in Time4 Popcorn for Windows, MacOS, and Android. Details on affected versions and patches are limited. The CVE record was published on 2026-08-27T20:17:33.780Z and has not been modified since then. Defenders should verify the information with the vendor or other trusted sources and monitor for suspicious activity related to the software.

Sources and references

Verified primary and authoritative sources

CVE-2026-30612 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-30612

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-30612 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-30612

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/Orcust-Automaton/Vulnerability/blob/main/LB-Link/AC1900_AZ2/bs_SetLimitCli_info.md

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.