BlackTreeCVE Intelligencewixtoolset · issues
Official source article: GitHub GHSA-RF39-3F98-XR7R ↗. Check the applicable product and release in the original source.
High technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
These OSV and GitHub advisory ranges apply only to the named package and ecosystem. A listed fixed version is not a universal product patch or proof that an update is installed.
| Ecosystem and package | Affected range | First fixed version | Evidence |
|---|---|---|---|
| NuGetWixToolset.Sdk | ECOSYSTEM: introduced 0; fixed 4.0.5 | 4.0.5 | OSV record ↗aggregator derived · 10 Sep 2026 |
| NuGetwix | ECOSYSTEM: introduced 0; fixed 3.14.1 | 3.14.1 | OSV record ↗aggregator derived · 10 Sep 2026 |
| NuGetwix | ECOSYSTEM: introduced 4.0.0; fixed 4.0.5 | 4.0.5 | OSV record ↗aggregator derived · 10 Sep 2026 |
High technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
Fix not verifiedWiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
An attacker operating through local access may attempt exploitation with low privileges. If successful, the issue may gain additional privileges.
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
An attacker operating through local access may attempt exploitation with low privileges. If successful, the issue may gain additional privileges.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
CISA Vulnrichment records proof-of-concept exploitation in its SSVC data. BlackTree has not independently executed or validated exploit material.
CWE-732: Incorrect Permission Assignment for Critical Resource. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 24 Mar 2024 · Last source change 13 Aug 2024, 14:28 UTC · CWE-732 · Incorrect Permission Assignment for Critical Resource
Core structured fields are present and their contributing authorities are shown above.
No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.