Vulnerability Details CVE-2026-42171
NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 0.5%
CVSS Severity
CVSS v3 Score 7.8
References
- https://github.com/NSIS-Dev/nsis/blob/7359413009afd4f0fff472d841fc2f2cc0e0a5f8/Source/exehead/util.c#L475-L484
- https://github.com/NSIS-Dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330ca
- https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-gettempfilename
- https://nsis.sourceforge.io/Docs/AppendixF.html#v3.12-cl
Products affected by CVE-2026-42171
-
cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:3.06.1
-
cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:3.07
-
cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:3.08
-
cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:3.09
-
cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:3.10
-
cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:3.11