CVE-2024-24810highCWE-426

CVE-2024-24810: high-severity vulnerability in wixtoolset issues

WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

Published · Updated

Follow this CVE+ Monitor issues+ Monitor wix

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.3epss 0.2%
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been patched in version 4.0.4.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
wixtoolset · issues
Related CVEs — wixtoolset issues

In the same product, most dangerous first.

CVE-2024-29187HIGHWiX based installers are vulnerable to binary hijack when run as SYSTEMEPSS 0.5%CVE-2024-29188HIGHMalicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated filesEPSS 0.2%