CVE-2025-43715

Name	CVE-2025-43715
Description	Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1103524

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nsis (PTS)	bullseye	3.06.1-1	vulnerable
	bullseye (security)	3.06.1-1+deb11u1	vulnerable
	bookworm	3.08-3+deb12u1	vulnerable
	trixie, sid	3.11-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nsis	source	(unstable)	3.11-1			1103524

Notes

https://sourceforge.net/p/nsis/bugs/1315/
https://nsis.sourceforge.io/Docs/AppendixF.html#v3.11-rl
Fixed by: https://sourceforge.net/p/nsis/code/7444/