---
id: CVE-2025-43715
title: >-
  Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local
  users to escalate privileges to SYSTEM during an installation, because the
  temporary plugins directory is created under %WINDIR%\temp and unprivileged
  users ca…
summary: >-
  Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local
  users to escalate privileges to SYSTEM during an installation, because the
  temporary plugins directory is created under %WINDIR%\temp and unprivileged
  users ca…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-754
published: '2025-04-17'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:18:07.120'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-43715'
references:
  - url: 'https://nsis.sourceforge.io/Docs/AppendixF.html#v3.11-rl'
    label: cve@mitre.org
  - url: 'https://sourceforge.net/p/nsis/bugs/1315/'
    label: cve@mitre.org
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-563922.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00326
epssPercentile: 0.25501
ingestedAt: '2026-10-15T03:30:12.812Z'
vendor: Nullsoft
product: Nullsoft Scriptable Install System
affected:
  - scriptable_install_system < 3.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-04-17T19:16:35.360975Z'
---

## Overview

Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.