CVE-2025-43715

EUVD-2025-11523
Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.91%
Debian logo
Debian Releases
Debian Product
Codename
nsis
bookworm
no-dsa
bullseye
postponed
bullseye (security)
vulnerable
forky
3.12-1
fixed
sid
3.12-1
fixed
trixie
3.11-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nsis
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
ignored
questing
ignored
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://nsis.sourceforge.io/Docs/AppendixF.html#v3.11-rl
https://sourceforge.net/p/nsis/bugs/1315/