CVE-2024-24810 HIGH

CVE-2024-24810: WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

Vendor Wixtoolset
Product issues
Weakness CWE-426
Published February 7, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been patched in version 4.0.4.

Key dates

02Disclosure timeline

February 7, 2024 CVE published
August 1, 2024 Record updated