← Back

CVE-2026-42171

nvd nist
Published: Apr 24, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: MITRE (Secondary)

Description

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).

Affected (1)

Nullsoft
1 product
Nullsoft Scriptable Install System
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Nullsoft Scriptable Install System
From 3.06.1 to 3.12

Related CWEs

CWE-427
Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

References (4)

Source: cve@mitre.org
Product
Source: cve@mitre.org
Patch
Source: cve@mitre.org
Product
Source: cve@mitre.org
Release Notes

Timeline

No history available yet.