Read the docs
TI-2025-28305 Aliases CVE-2025-43715GHSA-g9m2-7jc6-pmvf

Improper check for unusual conditions in Nullsoft Scriptable Install System

Priority LOW 37CWE-754Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00326 25th percentileScored 2026-11-07
Fix Fixed Nullsoft Scriptable Install System (Nullsoft): 3.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NullsoftNullsoft Scriptable Install Systembefore 3.113.11Patch availableCNA
  • Nullsoft Scriptable Install System VendorNullsoft Affected before 3.11 Fixed in 3.11 Patch available CNA

Remediation

  • Fix · CNA Nullsoft Scriptable Install System (Nullsoft) Fixed in 3.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-43715
  2. 2026-10-03 Alias added: GHSA-g9m2-7jc6-pmvf

References

Other 2

  • TI-2006-00462 Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 7.6
  • TI-2004-01250 Format string vulnerability in SHOUTcast 1.9.4 allows remote attackers to cause a denial… CVSS 2.0HIGH 7.5
  • TI-2009-01743 The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552… CVSS 2.0HIGH 9.3
  • TI-2009-00246 Multiple buffer overflows in Winamp 5.541 and earlier allow remote attackers to cause a… CVSS 2.0HIGH 10.0
  • TI-2004-01016 Stack-based buffer overflow in IN_CDDA.dll in Winamp 5.05, and possibly other versions… CVSS 2.0HIGH 10.0
  • TI-2006-05378 Multiple heap-based buffer overflows in AOL Nullsoft WinAmp before 5.31 allow… CVSS 2.0HIGH 9.3
See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences