CVE-2025-43715 HIGH

CVE-2025-43715

Vendor Nullsoft
Product Nullsoft Scriptable Install System
Weakness CWE-754
Published April 17, 2025
Last update April 17, 2025
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Local
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.

Key dates

02Disclosure timeline

April 17, 2025 CVE published
April 17, 2025 Record updated