CVE-2025-43715CWE-754

CVE-2025-43715

High · published April 17, 2025

CVSS v3.1

8.1

EPSS

Percentile

14.6

In the wild

Unconfirmed

What it is

Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00243 · 14.6th percentile
Weakness: CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published: 2025-04-17T07:15Z

References (3)

https://nsis.sourceforge.io/Docs/AppendixF.html#v3.11-rl · [email protected]https://sourceforge.net/p/nsis/bugs/1315/ · [email protected]https://cert-portal.siemens.com/productcert/html/ssa-563922.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

EPSS history

Timeline

17 APR 00:00Z
Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the…
cvelistv5