CVE-2026-42171CWE-427

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to…

High · published April 24, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00239 · 14.1th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2026-04-24T21:20Z
EPSS history
Timeline
  • 24 APR 21:20Z
    NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to…
    cvelistv5