Executive brief
The Nullsoft Scriptable Install System (NSIS), a popular tool for creating Windows software installers, contains a vulnerability that can allow a local user to gain administrative control. When an installer created with an affected version of NSIS is run with high privileges (SYSTEM), it may incorrectly use a temporary directory that is accessible to standard, low-privileged users. An attacker can exploit this behavior to place malicious files in that directory, which the installer then executes, leading to a full system takeover.
Technical details
A privilege escalation vulnerability exists in NSIS versions 3.06.1 through 3.11 due to an uncontrolled search path element (CWE-427). When an NSIS-generated installer executes with SYSTEM privileges, it may fallback to using a Low Integrity Level (Low IL) temporary directory if certain conditions are met (such as causing the 'my_GetTempFileName' function to return 0). Because Low IL directories are writable by standard users, a local attacker can perform a DLL hijacking or file replacement attack. By placing malicious code in the temporary directory before the installer accesses it, the attacker can achieve arbitrary code execution with SYSTEM privileges. This issue was addressed in NSIS version 3.12.
Affected products
- Nullsoft Nullsoft Scriptable Install System (NSIS) 3.06.1 before 3.12
Timeline
- 2026-04-24: advisory: CVE-2026-42171 published
- 2026-04-19: patched: NSIS 3.12 released fixing the issue
References
- https://github.com/NSIS-Dev/nsis/blob/7359413009afd4f0fff472d841fc2f2cc0e0a5f8/Source/exehead/util.c
- https://github.com/NSIS-Dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330ca
- https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-gettempfilename
- https://nsis.sourceforge.io/Docs/AppendixF.html