CVE-2026-42171

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/NSIS-Dev/nsis/blob/7359413009afd4f0fff472d841fc2f2cc0e0a5f8/Source/exehead/util.c#L475-L484	Product
https://github.com/NSIS-Dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330ca	Patch
https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-gettempfilename	Product
https://nsis.sourceforge.io/Docs/AppendixF.html#v3.12-cl	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-24 22:16

Updated : 2026-06-17 10:47

NVD link : CVE-2026-42171

Mitre link : CVE-2026-42171

CVE.ORG link : CVE-2026-42171

JSON object : View

Products Affected

nullsoft

nullsoft_scriptable_install_system

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2026-42171", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42171", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-25T01:56:27.818440Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Nullsoft", "product": "Nullsoft Scriptable Install System", "versions": [{"status": "affected", "version": "3.06.1", "lessThan": "3.12", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-24T22:16:01.540", "references": [{"url": "https://github.com/NSIS-Dev/nsis/blob/7359413009afd4f0fff472d841fc2f2cc0e0a5f8/Source/exehead/util.c#L475-L484", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/NSIS-Dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330ca", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-gettempfilename", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.12-cl", "tags": ["Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references)."}], "lastModified": "2026-06-17T10:47:27.900", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A2CA663-6F00-478D-BAFC-D53DB9A06C25", "versionEndExcluding": "3.12", "versionStartIncluding": "3.06.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}