CVE-2026-42171: high-severity vulnerability in Nullsoft Scriptable Install System
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.8epss 0.2%
NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Nullsoft · Nullsoft Scriptable Install SystemRelated CVEs — Nullsoft Scriptable Install System
In the same product, most dangerous first.
References
https://github.com/NSIS-Dev/nsis/blob/7359413009afd4f0fff472d841fc2f2cc0e0a5f8/Source/exehead/util.c#L475-L484https://github.com/NSIS-Dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330cahttps://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-gettempfilenamehttps://nsis.sourceforge.io/Docs/AppendixF.html#v3.12-cl