CVE-2025-43715

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-17 · updated 2026-10-15
Weakness: CWE-754

Description

Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.

Affected products

Nullsoft Scriptable Install System: before 3.11 — fixed in 3.11

How to fix

Upgrade to a fixed version: Nullsoft Scriptable Install System 3.11. Check the vendor advisory for mitigations.

References

https://nsis.sourceforge.io/Docs/AppendixF.html#v3.11-rl
https://sourceforge.net/p/nsis/bugs/1315/
https://cert-portal.siemens.com/productcert/html/ssa-563922.html

Get alerted when CVE-2025-43715 or the next vulnerability affects your stack