CVE-2024-29187 — Vulnerability in wix — CVE Details

HIGH

WiX based installers are vulnerable to binary hijack when run as SYSTEM

Published March 25, 2024Updated September 10, 2026Source: osv

Summary

### Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. ### Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. icacls c:\windows\temp **BUILTIN\Users:(CI)(S,WD,AD,X)** BUILTIN\Administrators:(F) BUILTIN\Administrators:(OI)(CI)(IO)(F) NT AUTHORITY\SYSTEM:(F) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) CREATOR OWNER:(OI)(CI)(IO)(F) Built in users(non-administrators) have special permissions to this folder and can create files and write to this directory. While they do not have explicit read permissions, there is a way they can monitor the changes to this directory using ReadDirectoryChangesW API and thus figure out randomized folder names created inside this directory as wel ### PoC PoC works against the against visual studio enterprise with update 3 [installer ](https://myvs.download.prss.microsoft.com/dbazure/en_visual_studio_enterprise_2015_with_update_3_x86_x64_dvd_8923288.iso?t=8132cd54-4b83-4478-8b73-fd9eb93437bf&P1=1709239640&P2=601&P3=2&P4=iorgKPv%2bG8n2NANTPUVoB92rr8t3W4XM594%2f9BtQQJrYrr8SwxGDxV%2fj%2f2F6Ulto0bXrIaFoZUr4yV37YAsOZVpM29IMtQEO0673AbDVuTe93qDb6wb7xdlpZSse0LZURUwwIFw5cwHQS2ZtvkunXE0osgXtEBT2IzVbPwVH39%2fum854xb4e2Dp61wgNrMZcOLLluBbeA3KX1sP3mm7WAWXBvlFiQWEnTfR5XH5mlLyPy2qfqCXWCjl84jNX7uY%2bpLR1IbfeD2JlcIQNeW2QrvmmqRrRbGvvaCA97IaSjM16XcDqVjvAEGW3sWXUc7y%2fEf68WZIyT7iilaEDUvaqqA%3d%3d&su=1) #### Reproduction steps As a standard user, run the poc. Mount the iso and run visual studio installer as local system account. The PoC should hijack the the binaries dropped by vs installer and a child process "notepad.exe" will be running. ### Impact This is an Elevation of Privilege Vulnerability where a low privileged user can hijack binaries in an unprotected path C:\Windows\Temp to elevate to the SYSTEM user privileges.

Advisory Timeline

First published March 25, 2024 (931 days ago).
Last revised September 10, 2026 — 898 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet

Update wix to 3.14.1 or later

dotnet add package wix --version 3.14.1

NuGet

Update WixToolset.Sdk to 4.0.5 or later

dotnet add package WixToolset.Sdk --version 4.0.5

NuGet

Update wix to 4.0.5 or later

dotnet add package wix --version 4.0.5

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: nuget (2).

Package	Ecosystem	Affected	Fixed In
wix	nuget	3.10.0, 3.10.0.1719-pre, 3.10.0.1726-pre, 3.10.0.2103-pre (+24 more)	3.14.1
WixToolset.Sdk	nuget	4.0.0, 4.0.1, 4.0.2, 4.0.3 (+1 more)	4.0.5
wix	nuget	4.0.0, 4.0.0.2926-pre, 4.0.0.3226-pre, 4.0.0.3922-pre (+6 more)	4.0.5

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-732
Incorrect Permission AssignmentMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.3 score means for each attack dimension.

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-29187?: WiX based installers are vulnerable to binary hijack when run as SYSTEM This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.3/10).
How do I check if my project is affected by CVE-2024-29187?: CVE-2024-29187 affects wix and WixToolset.Sdk. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-29187 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.3

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-rf39-3f98-xr7r

Related CVEs

CVE-2024-24810
HIGH
WiX Toolset's .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges
CVE-2026-106112
HIGH
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
CVE-2026-106115
HIGH
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
CVE-2024-29188
HIGH
Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies