Skip to content
OpenAdvisories

Product · wixtoolset

issues

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.8
    CVE-2024-29188

    Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files

    WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire…

    wixtoolset issues wix WixToolset.Util.wixext NuGet
  • High 7.3
    CVE-2024-29187

    WiX based installers are vulnerable to binary hijack when run as SYSTEM

    WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard …

    wixtoolset issues wix WixToolset.Sdk NuGet
  • High 8.3
    CVE-2024-24810

    WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

    WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX in…

    wixtoolset issues wix NuGet