PT-2025-16929 · Nullsoft+1 · Nsis+1

Sandro Poppi · Published 2025-04-16 · Updated 2026-04-09 · CVE-2025-43715

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nullsoft Scriptable Install System (NSIS) versions prior to 3.11

Description The issue allows local users to escalate privileges to SYSTEM during an installation. This occurs because the temporary plugins directory is created under %WINDIR%temp and unprivileged users can place a crafted executable file by winning a race condition. The EW CREATEDIR does not always set the CreateRestrictedDirectory error flag.

Recommendations For versions prior to 3.11, update to version 3.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the temporary plugins directory under %WINDIR%temp to minimize the risk of exploitation.

Fix

LPE

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2025-10968

CVE-2025-43715

Affected Products

Debian

Nsis

References · 19

• https://security-tracker.debian.org/tracker/CVE-2025-43715 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-43715 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43715 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43715 · Security Note
• https://osv.dev/vulnerability/CVE-2025-43715 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-43715 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-43715 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10968 · Security Note
• https://github.com/nmap/npcap/releases?after=v0.83 · Note
• https://twitter.com/AmberWolfSec/status/2042269041541140532 · Twitter Post
• https://nsis.sourceforge.io/Docs/AppendixF.html#v3.11-rl · Note
• https://twitter.com/cracbot/status/1914635354784616900 · Twitter Post
• https://twitter.com/CVEnew/status/1912722250282799133 · Twitter Post
• https://t.me/cvetracker/21834 · Telegram Post
• https://twitter.com/cybercronai/status/1912857447649194075 · Twitter Post