CVE-2015-9268
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version...
CVE-2015-9268 is a high vulnerability (CVSS 7.8) in Nullsoft Scriptable Install System, published October 1, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 74th percentile. Fixed in nsis 2.50-1.
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
- Record
CVE-2015-9268- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
- Record
CVE-2015-9268- Updated
- 2026-11-02
EUVDEUVD-2015-9110 No score
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
- Record
EUVD-2015-9110- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xcj3-538v-c35r
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version...
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
- Record
GHSA-xcj3-538v-c35r- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
- Record
CVE-2015-9268- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-9268
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
- Record
DEBIAN-CVE-2015-9268- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-9268
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
- Record
UBUNTU-CVE-2015-9268- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nsisDebian:12 |
before 2.50-1 | 2.50-1 |
nsisDebian:13 |
before 2.50-1 | 2.50-1 |
nsisDebian:14 |
before 2.50-1 | 2.50-1 |
nsisDebian:8 |
before 2.46-10+deb8u1, plus listed versions 2.46-10 |
2.46-10+deb8u1 |
nsisUbuntu:Pro:14.04:LTS |
before 2.46-7ubuntu0.1~esm1, plus listed versions 2.46-7 |
2.46-7ubuntu0.1~esm1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.debian.org/debian-lts-announce/2018/11/msg00041.html
sourceforge.net/p/nsis/bugs/1125
jvn.jp/en/jp/JVN68418039/index.html
nvd.nist.gov/vuln/detail/CVE-2015-9268
github.com/advisories/GHSA-xcj3-538v-c35r
security-tracker.debian.org/tracker/CVE-2015-9268
ubuntu.com/security/CVE-2015-9268
cve.org/CVERecord?id=CVE-2015-9268