Medium severity5.5NVD Advisory· Published Oct 1, 2018· Updated Jun 17, 2026

CVE-2015-9267

Description

Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nullsoft/Nullsoft Scriptable Install System2 versions
cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:*:*:*:*:*:*:*:*range: <2.49
- (no CPE)range: <2.49
Debian/linux
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

sourceforge.net/p/nsis/bugs/1125/nvdExploitIssue TrackingPatchThird Party Advisory
jvn.jp/en/jp/JVN68418039/index.htmlnvdThird Party Advisory
lists.debian.org/debian-lts-announce/2018/11/msg00041.htmlnvdMailing ListThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000