NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain…

NSIS (Nullsoft Scriptable Install System) versions 3.06.1 through 3.12 contain a privilege escalation vulnerability. The issue occurs when NSIS executes as SYSTEM and sometimes uses the Low IL temp directory. Local attackers can exploit this vulnerability to gain elevated privileges by causing the my_GetTempFileName function to return 0. This affects installations and deployments using vulnerable NSIS versions where attackers have local access to the system.