Nullsoft Scriptable Install System
Monthly
Local privilege escalation in Nullsoft Scriptable Install System (NSIS) 3.06.1 before 3.12 arises because an installer running as SYSTEM can fall back to the world-writable Low Integrity temp directory (c:\Windows\Temp\Low) when temp-file creation fails, letting a local low-privileged attacker plant content that the SYSTEM process trusts and thereby gain SYSTEM privileges. Exploitation requires an elevated NSIS installer to execute (UI:R) and hinges on forcing my_GetTempFileName to return 0, per the referenced bug #1326. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with SSVC exploitation status 'none'.
Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Local privilege escalation in Nullsoft Scriptable Install System (NSIS) 3.06.1 before 3.12 arises because an installer running as SYSTEM can fall back to the world-writable Low Integrity temp directory (c:\Windows\Temp\Low) when temp-file creation fails, letting a local low-privileged attacker plant content that the SYSTEM process trusts and thereby gain SYSTEM privileges. Exploitation requires an elevated NSIS installer to execute (UI:R) and hinges on forcing my_GetTempFileName to return 0, per the referenced bug #1326. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with SSVC exploitation status 'none'.
Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.