Vulnerabilidades de Nullsoft

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Nullsoft: 2 registro(s), com severidade, exploração e correções.

Nullsoft Scriptable Install System 2

Somente exploradas (KEV) →

CVE-2026-42171 Alta · 7.8 CWE-427 24/04/2026

Uncontrolled Search Path Element em Nullsoft Nullsoft Scriptable Install System

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).

CVE-2025-43715 Alta · 8.1 CWE-754 17/04/2025

Improper Check for Unusual or Exceptional Conditions em Nullsoft Nullsoft Scriptable Install System

Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.