EUVD-2026-25637Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local attacker needs an unprivileged account (PR:L) and must win a non-default fallback/race to force my_GetTempFileName=0 (AC:H) while an elevated installer runs (UI:R); success yields full SYSTEM compromise (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).
AnalysisAI
Local privilege escalation in Nullsoft Scriptable Install System (NSIS) 3.06.1 before 3.12 arises because an installer running as SYSTEM can fall back to the world-writable Low Integrity temp directory (c:\Windows\Temp\Low) when temp-file creation fails, letting a local low-privileged attacker plant content that the SYSTEM process trusts and thereby gain SYSTEM privileges. Exploitation requires an elevated NSIS installer to execute (UI:R) and hinges on forcing my_GetTempFileName to return 0, per the referenced bug #1326. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with SSVC exploitation status 'none'.
Technical ContextAI
NSIS is a widely used script-driven installer authoring toolkit for Windows; the affected component is the installer stub (exehead) shipped inside every generated installer, specifically the temp-directory selection logic in Source/exehead/util.c (my_GetTempFileName) and the startup path in Source/exehead/Main.c. The root cause maps to CWE-427 (Uncontrolled Search Path Element): when the primary temp-file allocation fails, the stub falls back to the shared Low Integrity temp location (c:\Windows\Temp\Low), which is writable by low-integrity/low-privileged processes. If the installer is itself running elevated (as SYSTEM), it then reads or executes attacker-controllable content from that shared directory, crossing a trust boundary. The fix commit (8e6f02205d) adds a UserIsAdminGrpMember() check so an elevated process skips the Low IL directory entirely.
RemediationAI
Vendor-released patch: NSIS 3.12 - upgrade the NSIS toolchain to 3.12 or later and rebuild/redistribute all installers so the fixed exehead stub (which skips the Low IL temp directory when elevated) is embedded; see the v3.12 change log at https://nsis.sourceforge.io/Docs/AppendixF.html#v3.12-cl and the fix commit https://github.com/NSIS-Dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330ca . Simply updating the toolchain is not enough for already-shipped products - previously built installers remain vulnerable until recompiled with 3.12+. As a compensating control where immediate rebuild is impossible, avoid running affected NSIS installers under the SYSTEM account (e.g., do not push them as SYSTEM via management tooling), and harden or remove the shared c:\Windows\Temp\Low directory's writability for untrusted local users, noting this may break other low-integrity applications that legitimately rely on that path.
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today