TI-2024-16327 Aliases CVE-2024-24810 GHSA-7wh2-wxc7-9ph5

WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

HIGH 71CWE-426Published 2024-02-07 · Updated 2024-08-01

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-426.

Summary

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been patched in version 4.0.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00235 14th percentileScored 2026-11-07

Fix Fixed wix (NuGet): 4.0.4, 3.14.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
wixtoolset	issues	up to 4.0.3	—	No fix listed	CNA
—	wix (NuGet)	4.0.0 to before 4.0.4	4.0.4	Patch available	GHSA-7wh2-wxc7-9ph5
—	wix (NuGet)	before 3.14.0	3.14.0	Patch available	GHSA-7wh2-wxc7-9ph5

issues Vendorwixtoolset Affected up to 4.0.3 Fixed in — No fix listed CNA
wix (NuGet) Vendor— Affected 4.0.0 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-7wh2-wxc7-9ph5
wix (NuGet) Vendor— Affected before 3.14.0 Fixed in 3.14.0 Patch available GHSA-7wh2-wxc7-9ph5

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:firegiant:wix_toolset::::::::	before 3.14.0; 4.0.0 to before 4.0.4	Vulnerable	Firegiant

cpe:2.3:a:firegiant:wix_toolset:*:*:*:*:*:*:*:* Versions before 3.14.0; 4.0.0 to before 4.0.4 Vulnerable ·Firegiant

Remediation

Fix · GHSA-7wh2-wxc7-9ph5 wix (NuGet) Fixed in 4.0.4 Advisory →
Fix · GHSA-7wh2-wxc7-9ph5 wix (NuGet) Fixed in 3.14.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-24810
2026-10-03 Alias added: GHSA-7wh2-wxc7-9ph5

References

Advisory 2

Other 2

TI-2024-19356 WiX based installers are vulnerable to binary hijack when run as SYSTEM CVSS 3.1HIGH 7.3
TI-2024-19357 Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences