CVE-2025-43715: NSIS Privilege Escalation Vulnerability

CVE-2025-43715 Overview

CVE-2025-43715 is a local privilege escalation vulnerability in Nullsoft Scriptable Install System (NSIS) versions before 3.11 on Windows. The flaw allows unprivileged local users to escalate to SYSTEM during installation by winning a race condition against the installer. NSIS creates its temporary plugins directory under %WINDIR%\temp, a path writable by standard users. An attacker can plant a crafted executable in this directory before the installer loads it. The root cause is that the EW_CREATEDIR instruction does not consistently set the CreateRestrictedDirectory error flag, leaving the directory permissions insufficiently restricted.

Critical Impact
Successful exploitation yields SYSTEM-level code execution on Windows hosts where any affected NSIS installer is run.

Affected Products

Nullsoft Scriptable Install System (NSIS) versions before 3.11 on Windows
Any Windows installer package built with a vulnerable NSIS version
Third-party software distributions bundling NSIS installers prior to 3.11

Discovery Timeline

2025-04-17 - CVE-2025-43715 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-43715

Vulnerability Analysis

The vulnerability is a race condition classified under [CWE-754] (Improper Check for Unusual or Exceptional Conditions). During execution, an NSIS installer extracts plugin DLLs and helper executables into a temporary directory under %WINDIR%\temp. When the installer runs with elevated privileges, those extracted files inherit a context where SYSTEM later loads them. Because the directory location is world-writable by default, a local attacker can race the installer between directory creation and file extraction. The attacker drops a malicious payload that the installer subsequently executes in the elevated context. This pattern matches a classic time-of-check to time-of-use (TOCTOU) abuse against installer temp paths.

Root Cause

The defect lives in the handling of the EW_CREATEDIR opcode inside the NSIS runtime. NSIS supports a CreateRestrictedDirectory flag that applies a restrictive Access Control List (ACL) to newly created directories. The flag is intended to prevent unprivileged users from writing into installer-controlled paths. However, EW_CREATEDIR does not always set this flag, so the temporary plugins directory under %WINDIR%\temp is created with permissive default permissions. This allows non-administrative users on the same host to modify directory contents while the installer is still executing.

Attack Vector

Exploitation requires local access and the ability to run code as a standard user while a vulnerable NSIS installer is launched with elevated privileges. The attacker monitors %WINDIR%\temp for the creation of NSIS plugin directories, then races to place a crafted DLL or executable matching a name the installer expects to load. When the installer invokes the planted file, the code executes as SYSTEM. The attack complexity is elevated by the timing requirement, but the technique is reliable with file-system change notifications and tight polling loops. No user interaction beyond the normal install workflow is required.

No public proof-of-concept exploit code is currently available. Refer to the SourceForge NSIS Bug Report #1315 for the upstream technical discussion.

Detection Methods for CVE-2025-43715

Indicators of Compromise

Unexpected executable or DLL files written to %WINDIR%\temp by non-installer processes shortly before an NSIS installer executes
NSIS installer processes loading modules from %WINDIR%\temp subdirectories with non-restrictive ACLs
Child processes spawned as NT AUTHORITY\SYSTEM from temp-resident binaries that do not match known installer payloads

Detection Strategies

Monitor file create and write events in %WINDIR%\temp correlated with NSIS installer parent processes
Alert when a standard user process writes a .dll or .exe into a directory subsequently loaded by an elevated installer
Hunt for module loads from C:\Windows\Temp\ns* paths where the loaded image was written by a non-SYSTEM, non-admin Security Identifier (SID)

Monitoring Recommendations

Enable Windows Sysmon Event IDs 1, 7, and 11 to capture process creation, image loads, and file creation in temp paths
Audit directory ACLs on %WINDIR%\temp and flag installer-created subdirectories lacking restrictive permissions
Track installer execution by hash and version metadata to identify NSIS builds older than 3.11 still in distribution

How to Mitigate CVE-2025-43715

Immediate Actions Required

Upgrade NSIS to version 3.11 or later and rebuild any installers produced with prior versions
Inventory deployed third-party installers and request updated builds from vendors still shipping pre-3.11 NSIS packages
Restrict who can execute unknown installers on shared and multi-user Windows hosts until patched builds are deployed

Patch Information

The issue is fixed in NSIS 3.11. The release notes documenting the fix are available in the NSIS Documentation v3.11. Software publishers must rebuild and redistribute their installers using the patched NSIS toolchain. Installing the patched NSIS compiler alone does not remediate already-distributed vulnerable installers.

Workarounds

Run installers only from accounts that are the sole interactive user on the system to reduce race-condition opportunity
Apply restrictive ACLs to %WINDIR%\temp or redirect installer temp paths to a directory writable only by administrators
Use application allowlisting to block execution of unsigned binaries originating from %WINDIR%\temp

bash

# Configuration example: tighten ACL on Windows Temp to block standard-user writes
icacls "%WINDIR%\temp" /inheritance:r
icacls "%WINDIR%\temp" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(CI)RX"