High
nsis — security advisory
NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).
- Products
- nsis
- Affected versions
- 2.46-10.1, 2.46-7, 2.46-7ubuntu0.1~esm1, 2.48-2, 2.50-1, 2.51-1, 3.04-1, 3.04-2, 3.05-1, 3.05-2, 3.06.1-1, 3.08-1, 3.08-2, 3.09-1, 3.09-2, 3.09-3, 3.09-4, 3.09-4ubuntu1, 3.10-2ubuntu1, 3.10-2ubuntu2
- Fixed versions
- Not specified
- CVEs
- CVE-2026-42171
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:44 UTC · Revision 1
Source evidence
NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).
osv:UBUNTU-CVE-2026-42171
nsis
Fixed versions: Not specified
nsis
Fixed versions: Not specified
nsis
Fixed versions: Not specified
nsis
Fixed versions: Not specified
nsis
Fixed versions: Not specified
nsis
Fixed versions: Not specified
nsis
Fixed versions: Not specified
nsis
Fixed versions: Not specified
nsis
Fixed versions: Not specified
Complete source record
{
"id": "b8b647c443356ea62a6d24a8e5d6d4f33692433fc2bda2cd3a88901517a7fd86",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-42171",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-42171",
"summary": "NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).",
"evidence": "osv:UBUNTU-CVE-2026-42171",
"products": [
{
"name": {
"value": "nsis",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.46-7",
"evidence": "/affected/0/versions"
},
{
"value": "2.46-7ubuntu0.1~esm1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "nsis",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.46-10.1",
"evidence": "/affected/1/versions"
},
{
"value": "2.48-2",
"evidence": "/affected/1/versions"
},
{
"value": "2.50-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "nsis",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.51-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "nsis",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.04-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.04-2",
"evidence": "/affected/3/versions"
},
{
"value": "3.05-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.05-2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "nsis",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.06.1-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.08-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.08-2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "nsis",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.09-1",
"evidence": "/affected/5/versions"
},
{
"value": "3.09-2",
"evidence": "/affected/5/versions"
},
{
"value": "3.09-3",
"evidence": "/affected/5/versions"
},
{
"value": "3.09-4",
"evidence": "/affected/5/versions"
},
{
"value": "3.09-4ubuntu1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "nsis",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.10-2ubuntu1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "nsis",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.10-2ubuntu2",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "nsis",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.10-2ubuntu1",
"evidence": "/affected/8/versions"
},
{
"value": "3.10-2ubuntu2",
"evidence": "/affected/8/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-42171",
"aliases": [
"UBUNTU-CVE-2026-42171"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nsis",
"purl": "pkg:deb/ubuntu/nsis?arch=source&distro=esm-infra-legacy%2Ftrusty",
"ecosystem": "Ubuntu:Pro:14.04:LTS"
},
"versions": [
"2.46-7",
"2.46-7ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42171.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nsis",
"binary_version": "2.46-7ubuntu0.1~esm1"
},
{
"binary_name": "nsis-common",
"binary_version": "2.46-7ubuntu0.1~esm1"
},
{
"binary_name": "nsis-pluginapi",
"binary_version": "2.46-7ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nsis",
"purl": "pkg:deb/ubuntu/nsis?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.46-10.1",
"2.48-2",
"2.50-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42171.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nsis",
"binary_version": "2.50-1"
},
{
"binary_name": "nsis-common",
"binary_version": "2.50-1"
},
{
"binary_name": "nsis-pluginapi",
"binary_version": "2.50-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nsis",
"purl": "pkg:deb/ubuntu/nsis?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"2.51-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42171.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nsis",
"binary_version": "2.51-1"
},
{
"binary_name": "nsis-common",
"binary_version": "2.51-1"
},
{
"binary_name": "nsis-pluginapi",
"binary_version": "2.51-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nsis",
"purl": "pkg:deb/ubuntu/nsis?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"3.04-1",
"3.04-2",
"3.05-1",
"3.05-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42171.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nsis",
"binary_version": "3.05-2"
},
{
"binary_name": "nsis-common",
"binary_version": "3.05-2"
},
{
"binary_name": "nsis-pluginapi",
"binary_version": "3.05-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nsis",
"purl": "pkg:deb/ubuntu/nsis?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"3.06.1-1",
"3.08-1",
"3.08-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42171.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nsis",
"binary_version": "3.08-2"
},
{
"binary_name": "nsis-common",
"binary_version": "3.08-2"
},
{
"binary_name": "nsis-pluginapi",
"binary_version": "3.08-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nsis",
"purl": "pkg:deb/ubuntu/nsis?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"3.09-1",
"3.09-2",
"3.09-3",
"3.09-4",
"3.09-4ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42171.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nsis",
"binary_version": "3.09-4ubuntu1"
},
{
"binary_name": "nsis-common",
"binary_version": "3.09-4ubuntu1"
},
{
"binary_name": "nsis-pluginapi",
"binary_version": "3.09-4ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nsis",
"purl": "pkg:deb/ubuntu/nsis?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"3.10-2ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42171.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nsis",
"binary_version": "3.10-2ubuntu1"
},
{
"binary_name": "nsis-common",
"binary_version": "3.10-2ubuntu1"
},
{
"binary_name": "nsis-pluginapi",
"binary_version": "3.10-2ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nsis",
"purl": "pkg:deb/ubuntu/nsis?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"3.10-2ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42171.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nsis",
"binary_version": "3.10-2ubuntu2"
},
{
"binary_name": "nsis-common",
"binary_version": "3.10-2ubuntu2"
},
{
"binary_name": "nsis-pluginapi",
"binary_version": "3.10-2ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nsis",
"purl": "pkg:deb/ubuntu/nsis?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"3.10-2ubuntu1",
"3.10-2ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42171.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nsis",
"binary_version": "3.10-2ubuntu2"
},
{
"binary_name": "nsis-common",
"binary_version": "3.10-2ubuntu2"
},
{
"binary_name": "nsis-pluginapi",
"binary_version": "3.10-2ubuntu2"
}
]
}
}
],
"modified": "2026-10-17T12:58:54.342113308Z",
"provider": "osv",
"upstream": [
"CVE-2026-42171"
],
"references": [
"https://ubuntu.com/security/CVE-2026-42171",
"https://www.cve.org/CVERecord?id=CVE-2026-42171"
]
},
"related_cves": [
{
"value": "CVE-2026-42171",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 359159,
"published_at": "2026-04-24T22:16:00+00:00"
}