VULNERABILITY INTELLIGENCE

CVE-2026-42171

CVSS score7.8 HIGH
EPSS probability0.21%
CISA KEVNot currently listed
Published2026-04-24
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).

Weakness classification

  • cve@mitre.org: CWE-427

Primary references