CVE-2026-42171: NSIS Privilege Escalation Vulnerability

CVE-2026-42171 Overview

CVE-2026-42171 is a local privilege escalation vulnerability in NSIS (Nullsoft Scriptable Install System) versions 3.06.1 through 3.11.1. The vulnerability exists because NSIS installers running with SYSTEM privileges may incorrectly use the Low Integrity Level (IL) temp directory, allowing local attackers to potentially escalate privileges by exploiting conditions where the my_GetTempFileName function returns 0.

Critical Impact
Local attackers can potentially gain SYSTEM-level privileges on affected Windows systems running vulnerable NSIS installers, enabling complete system compromise.

Affected Products

NSIS (Nullsoft Scriptable Install System) versions 3.06.1 to 3.11.1
Windows installers built with affected NSIS versions
Systems running NSIS-based installers as SYSTEM

Discovery Timeline

2026-04-24 - CVE-2026-42171 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-42171

Vulnerability Analysis

This vulnerability is classified as CWE-427 (Uncontrolled Search Path Element), which occurs when NSIS installers running with elevated SYSTEM privileges incorrectly fall back to using the Low Integrity Level temp directory (C:\Windows\Temp\Low). Under specific conditions—when the ValidateTempDir() function fails and my_GetTempFileName returns 0—the installer may attempt to use a shared directory accessible to lower-privileged users.

When an NSIS installer runs as SYSTEM, it normally uses the Windows directory's temp folder (C:\Windows\Temp). However, the vulnerable code path allowed a fallback to the Low IL temp directory (originally implemented as a workaround for Bug #2909242 to support Low Integrity Level processes like Internet Explorer). This creates a race condition where a local attacker with standard user privileges could plant malicious files in the shared Low IL temp directory before the SYSTEM-level installer processes them.

The fix ensures that when the installer detects it's running with elevated privileges (via UserIsAdminGrpMember() check), it no longer falls back to the Low IL temp directory, preventing privilege escalation attacks.

Root Cause

The root cause lies in the temp directory selection logic within Source/exehead/Main.c. The code originally implemented a fallback mechanism to use the Low IL temp directory when the primary temp directory validation failed. This fallback was intended for low-privilege scenarios but was incorrectly triggered even when running as SYSTEM, creating an exploitable privilege escalation condition.

Attack Vector

The attack requires local access to the target system. An attacker would need to:

Identify when a vulnerable NSIS installer is executed with SYSTEM privileges
Manipulate conditions to cause my_GetTempFileName to return 0
Pre-populate the Low IL temp directory with malicious files
Wait for the SYSTEM-level installer to process the attacker-controlled files

   {
     GetWindowsDirectory(state_temp_dir, NSIS_MAX_STRLEN - 5); // leave space for \Temp
     mystrcat(state_temp_dir, _T("\\Temp"));

     if (!ValidateTempDir())
     {
+      // Bug #1326:
+      // Don't try the Low IL temp directory if we are elevated.
+      // This prevents the SYSTEM user from using the shared c:\Windows\Temp\Low directory.
+      if (UserIsAdminGrpMember()) goto end;

       // Bug #2909242:
       // When running at <= Low IL we cannot write to %Temp% but we can try the temp folder used by IE.
       // There does not seem to be a API to get the low temp dir directly, so we build the path on our own

Source: GitHub Commit Changes

Detection Methods for CVE-2026-42171

Indicators of Compromise

Unusual file creation activity in C:\Windows\Temp\Low by SYSTEM processes
NSIS installer processes accessing the Low IL temp directory while running with elevated privileges
Suspicious DLLs or executables appearing in the Low IL temp directory before installer execution

Detection Strategies

Monitor for NSIS installer processes (makensis.exe or generated installers) running as SYSTEM that access C:\Windows\Temp\Low
Implement file integrity monitoring on the Low IL temp directory to detect pre-staged malicious files
Use endpoint detection to identify privilege escalation attempts involving temp directory manipulation

Monitoring Recommendations

Enable Windows Security auditing for object access on C:\Windows\Temp\Low
Configure SIEM rules to alert on SYSTEM-level processes interacting with Low IL directories
Deploy behavioral analysis to detect temp directory race condition exploitation patterns

How to Mitigate CVE-2026-42171

Immediate Actions Required

Upgrade NSIS to version 3.12 or later immediately
Audit and rebuild any installers created with NSIS versions 3.06.1 through 3.11.1
Review systems where NSIS-based installers run with SYSTEM privileges for signs of compromise

Patch Information

The vulnerability was addressed in NSIS version 3.12. The security patch adds a check via UserIsAdminGrpMember() to prevent elevated processes from falling back to the Low IL temp directory. Organizations should upgrade to NSIS 3.12 or later and rebuild all installers created with vulnerable versions.

The fix was documented in the NSIS 3.12 changelog with credit to Richard Warren for responsible disclosure (Bug #1326). The security patch commit shows the specific code changes implemented.

Workarounds

Restrict write access to C:\Windows\Temp\Low for non-administrative users where possible
Avoid running NSIS-based installers as SYSTEM until patched versions are deployed
Implement application whitelisting to prevent unauthorized executables in temp directories
Monitor and alert on any file creation in Low IL directories by elevated processes

bash

# Configuration example
# Restrict permissions on Low IL temp directory (PowerShell)
icacls "C:\Windows\Temp\Low" /inheritance:r /grant "SYSTEM:(OI)(CI)F" /grant "Administrators:(OI)(CI)F"

# Verify NSIS version before building installers
makensis /VERSION
# Ensure output shows 3.12 or higher