CVE-2026-42171

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).

CVSS 3.1

7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-26)

CWE

CWE-427

Published

2026-04-24

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• nullsoft:nullsoft_scriptable_install_system

References

• https://github.com/NSIS-Dev/nsis/blob/7359413009afd4f0fff472d841fc2f2cc0e0a5f8/Source/exehead/util.c#L475-L484
• https://github.com/NSIS-Dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330ca
• https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-gettempfilename
• https://nsis.sourceforge.io/Docs/AppendixF.html#v3.12-cl

Check your stackJSON