PT-2026-35088 · Nullsoft+2 · Nullsoft Scriptable Install System+1

Published 2026-04-24 · Updated 2026-05-18 · CVE-2026-42171

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NSIS (Nullsoft Scriptable Install System) versions 3.06.1 through 3.11

Description When executing as SYSTEM, the software sometimes uses the Low Integrity Level (Low IL) temporary directory. This allows local attackers to gain elevated privileges if they can cause the my GetTempFileName() function to return 0.

Recommendations Update to version 3.12.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2026-42171

Affected Products

Nullsoft Scriptable Install System

Nsis

References · 11

• https://github.com/NSIS-Dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330ca · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42171 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42171 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42171 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42171 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42171 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42171 · Security Note
• https://github.com/NSIS-Dev/nsis/blob/7359413009afd4f0fff472d841fc2f2cc0e0a5f8/Source/exehead/util.c#L475-L484 · Note
• https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-gettempfilename · Note
• https://nsis.sourceforge.io/Docs/AppendixF.html#v3.12-cl · Note
• https://t.me/cveNotify/163856 · Telegram Post