Nullsoft Scriptable Install System vulnerabilities

2 known vulnerabilities in Nullsoft Scriptable Install System from Nullsoft. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Nullsoft Scriptable Install System: Uncontrolled Search Path Element

  CVE-2026-42171Apr 24, 2026Nullsoft

  NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).

• 8.1 High severity

  Nullsoft Scriptable Install System: Improper Check for Unusual or Exceptional Conditions

  CVE-2025-43715Apr 17, 2025Nullsoft

  Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted execu