High severity7.8NVD Advisory· Published Apr 24, 2026· Updated May 18, 2026
CVE-2026-42171
CVE-2026-42171
Description
NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:*:*:*:*:*:*:*:*Range: >=3.06.1,<3.12
Patches
Vulnerability mechanics
References
4- github.com/NSIS-Dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330canvdPatch
- github.com/NSIS-Dev/nsis/blob/7359413009afd4f0fff472d841fc2f2cc0e0a5f8/Source/exehead/util.cnvdProduct
- learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-gettempfilenamenvdProduct
- nsis.sourceforge.io/Docs/AppendixF.htmlnvdRelease Notes
News mentions
0No linked articles in our index yet.