Vulnerability Description
NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nullsoft | Nullsoft Scriptable Install System | >= 3.06.1, < 3.12 |
Related Weaknesses (CWE)
References
- https://github.com/NSIS-Dev/nsis/blob/7359413009afd4f0fff472d841fc2f2cc0e0a5f8/SProduct
- https://github.com/NSIS-Dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330caPatch
- https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-gettempfiProduct
- https://nsis.sourceforge.io/Docs/AppendixF.html#v3.12-clRelease Notes
FAQ
What is CVE-2026-42171?
CVE-2026-42171 is a vulnerability with a CVSS score of 7.8 (HIGH). NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTem...
How severe is CVE-2026-42171?
CVE-2026-42171 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-42171?
Check the references section above for vendor advisories and patch information. Affected products include: Nullsoft Nullsoft Scriptable Install System.