CVE-2026-42171

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).

Database specific

{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-427"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42171.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "3.06.1"
                },
                {
                    "fixed": "3.12"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "3.06.1"
                },
                {
                    "fixed": "3.12"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "3.06.1"
                },
                {
                    "fixed": "3.12"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/nsis-dev/nsis

Affected ranges

Type

GIT

Repo

https://github.com/nsis-dev/nsis

Events

Introduced

Fixed

8e6f02205d5f22da6c7855dbfe59b2af667330ca

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

Other

v20

v201

v202

v203

v204

v205

v206

v207

v207b0

v208

v20b1

v20b2

v20b3

v20b4

v20rc1

v20rc2

v20rc3

v20rc4

v210

v211

v212

v213

v214

v215

v216

v217

v218

v219

v220

v221

v222

v223

v224

v225

v226

v227

v228

v229

v230

v231

v232

v233

v234

v235

v236

v237

v238

v239

v240

v241

v242

v243

v244

v245

v246

v30

v301

v3021

v303

v304

v305

v306

v3061

v307

v308

v309

v30a1

v30a2

v30b0

v30b1

v30b2

v30b3

v30rc1

v30rc2

v310

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42171.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "40512102880778658124896654791287957887",
                "55883558779287910620366181330180973683",
                "171359798556859465837194176206311633652",
                "293583849916359373402897435193249486875",
                "136849797675635699153538033358179384812",
                "314530838814439634160380642676912934191"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-42171-336dc970",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/nsis-dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330ca",
        "target": {
            "file": "Source/exehead/Main.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "192538915003321576615560420739527501523",
            "length": 7211
        },
        "id": "CVE-2026-42171-52b4332c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/nsis-dev/nsis/commit/8e6f02205d5f22da6c7855dbfe59b2af667330ca",
        "target": {
            "file": "Source/exehead/Main.c",
            "function": "NSISWinMainNOCRT"
        }
    }
]

vanir_signatures_modified

"2026-08-12T16:24:18Z"