Description
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.
References (3)
Core 3
Core References
Patch x_refsource_misc
https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7
Patch x_refsource_misc
https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9
Issue Tracking x_refsource_confirm
https://github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r
Scores
CVSS v3
7.3
EPSS
0.0008
EPSS Percentile
23.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-732
Status
published
Products (4)
nuget/wix
0 - 3.14.1NuGet
nuget/WixToolset.Sdk
0 - 4.0.5NuGet
wixtoolset/issues
< 3.14.1
wixtoolset/issues
>= 4.0.0, < 4.0.5
Published
Mar 24, 2024
Tracked Since
Feb 18, 2026