CVEvulnerability

CVE-2026-42171

7.8 HIGH Published 2026-04-24 Modified 2026-10-26 Official page ↗

Status: Analyzed
Published: 2026-04-24
Last modified: 2026-10-26
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-427

Description

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).

Affected configurations

• nullsoft nullsoft scriptable install system (>= 3.06.1 < 3.12)

Weakness · CWE (1)

CWE-427 Uncontrolled Search Path Element weakness

References

https://github.com/NSIS-Dev/nsis/blob/7359413009afd4f0fff472d841fc2f2cc0e0a5f8/Source/exehead/util.c#L475-L484 Product
https://github.com/NSIS-Dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330ca Patch
https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-gettempfilename Product
https://nsis.sourceforge.io/Docs/AppendixF.html#v3.12-cl Release Notes

CVE-2026-42171

Description

Affected configurations

Related

Weakness · CWE (1)

References