Pete Batard from Akeo Consulting has released an official update for the popular Rufus utility to version 4.15. Dated June 30, 2026, this release is one of the most significant in recent times, as it addresses a number of critical issues affecting the stability and security of the bootable media creation process.

Distributed under the free GPLv3 license, the program remains the de facto standard for writing images to USB drives. It requires no installation, is digitally signed by the developer, and ensures low-level direct writing, supporting MBR and GPT partition tables for BIOS and UEFI systems. However, serious flaws had accumulated in previous versions, which are now resolved.

WUE Logic Fix and "Silent" Installation

One of the main innovations was the overhaul of the Windows User Experience (WUE) module. This feature allows users to modify Windows 11 distributions directly during the writing process, disabling mandatory Microsoft requirements: the presence of a TPM 2.0 chip, Secure Boot, and UEFI. WUE also allows blocking telemetry, removing OneDrive, and bypassing the Microsoft account binding.

In versions prior to 4.15, including the 4.14 branch, there were system crashes that caused user settings to reset after restarting the utility, and some parameters were forcibly enabled. In the new release, the logic for saving configuration files has been completely reworked, guaranteeing the preservation of selected flags.

Furthermore, a critical bug causing the automatic ("silent") Windows installation process to hang at the 75% mark has been eliminated. The issue occurred when working with ISO images containing multiple WIM (Windows Imaging Format) files. Incorrect handling of such images put the program's algorithm into an infinite parsing loop, making it impossible to complete the installation.

Closing Vulnerabilities in the Metadata Parser

Security in handling untrusted images became a priority for developers. The built-in ezxml.c metadata parser underwent a deep audit, during which three high-severity vulnerabilities were identified and fixed:

  • Unlimited XML Entity Expansion (Billion Laughs): This vulnerability allowed a Denial of Service (DoS) attack on the device when reading a malicious ISO image. Recursive link expansion without memory control led to a complete system hang.
  • Integer Buffer Overflow: The error occurred when processing strings larger than 2 GB, leading to a heap overflow and potential application crash.
  • Value Truncation during Reallocation: The data type in the _realloc() function for 64-bit builds has been corrected (from unsigned int to size_t), preventing the allocation of incorrect memory volumes.

Support for New Architectures and Crash Fixes

Version 4.15 also expanded support for hardware platforms. Full support for the RISC-V 64 architecture was implemented in the UEFI:NTFS bootloader. This opens up possibilities for using the utility on new classes of devices using open processor architectures.

Special attention was paid to stability on devices with ARM64 processors. Engineers eliminated a hardware failure that led to critical data corruption and a Blue Screen of Death (BSOD) during the boot phase. The issue affected modern laptops and tablets based on Qualcomm Snapdragon X chips using UEFI:NTFS.

The Rufus 4.15 update is recommended for all users working with Windows distributions, especially those using the utility for system deployment automation or working with non-standard processor architectures.