Nullsoft Scriptable Install System
Vendor:
First CVE: Oct 1, 2018 · Active for 7 years
5
Total CVEs
More Total CVEs than 77% of tracked products
1.3
Avg CVEs / Year
Higher CVE frequency than 55% of tracked products
6.9
Avg CVSS
Higher Avg CVSS than 39% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Nullsoft Scriptable Install System over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 1, 2018
7 years ago
Most Recent CVE
Apr 24, 2026
91 days ago
CVE Severity & Scoring
Nullsoft Scriptable Install System5 CVEs
40%
60%
All CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local4 (80.0%)
Network1 (20.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low4 (80.0%)
High1 (20.0%)
Unknown0 (0.0%)
User Interaction
None3 (60.0%)
Unknown0 (0.0%)
Required2 (40.0%)
Privileges Required
Low1 (20.0%)
High0 (0.0%)
None4 (80.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-42171HIGH NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they | Apr 24, 2026 | 7.8 | 30 | NO | NO |
CVE-2025-43715HIGH Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory | Apr 17, 2025 | 8.1 | 21 | NO | NO |
CVE-2023-37378MEDIUM Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory. | Jul 3, 2023 | 5.3 | 20 | NO | NO |
CVE-2015-9268HIGH Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function | Oct 1, 2018 | 7.8 | 20 | NO | NO |
CVE-2015-9267MEDIUM Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which ei | Oct 1, 2018 | 5.5 | 17 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (5 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (5 CVEs).
Media Mentions
Signals from CVEs in this product scope (5 CVEs).
Top CNAs Publishing CVEs For Nullsoft Scriptable Install System
Top CWEs
Versions
No cataloged versions.