What’s Vulnerable › Vulnerabilities

CVE-2026-42171

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-24 · updated 2026-10-26
• Weakness: CWE-427

Description

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).

Affected products

• Nullsoft Scriptable Install System: from 3.06.1 before 3.12 — fixed in 3.12

How to fix

Upgrade to a fixed version: Nullsoft Scriptable Install System 3.12. Check the vendor advisory for mitigations.

References

• https://github.com/NSIS-Dev/nsis/blob/7359413009afd4f0fff472d841fc2f2cc0e0a5f8/Source/exehead/util.c#L475-L484
• https://github.com/NSIS-Dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330ca
• https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-gettempfilename
• https://nsis.sourceforge.io/Docs/AppendixF.html#v3.12-cl

Get alerted when CVE-2026-42171 or the next vulnerability affects your stack