{"id":"CVE-2024-29187","summary":"WiX based installers are vulnerable to binary hijack when run as SYSTEM","details":"WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\\Windows\\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.","aliases":["GHSA-rf39-3f98-xr7r"],"modified":"2026-08-12T15:12:58.583805Z","published":"2024-03-24T19:38:38.140Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-732"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29187.json","unresolved_ranges":[{"extracted_events":[{"fixed":"3.14.1"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29187.json"},{"type":"ADVISORY","url":"https://github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29187"},{"type":"FIX","url":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7"},{"type":"FIX","url":"https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wixtoolset/wix","events":[{"introduced":"8c757c0f67f26f21c6bcbbfb81b7ea8b91c35fe4"},{"fixed":"75a8c75d4e02ea219008dc5af7d03869291d61f7"}],"database_specific":{"extracted_events":[{"introduced":"4.0.0"},{"fixed":"4.0.5"}],"source":["AFFECTED_FIELD","REFERENCES"]}},{"type":"GIT","repo":"https://github.com/wixtoolset/wix3","events":[{"introduced":"0"},{"fixed":"6d372e5169f1a334a395cdf496443bc0732098e9"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v4.0.4","v4.0.3","v4.0.2","v4.0.1","v4.0.0","wix314rtm","wix311rtm","wix3102rtm","wix3101rtm","wix310rtm","wix39rtm","wix38rtm"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29187.json","vanir_signatures_modified":"2026-08-12T15:12:58Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"223621071977632368660516478838536570040","length":4307},"id":"CVE-2024-29187-16b2d26f","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/core.cpp","function":"CoreInitialize"}},{"deprecated":false,"digest":{"length":338,"function_hash":"270231578976514179393961950993284800784"},"id":"CVE-2024-29187-19181fee","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9","target":{"file":"src/burn/engine/cache.cpp","function":"CacheCalculateContainerWorkingPath"}},{"signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/cache.cpp","function":"CopyEngineToWorkingFolder"},"deprecated":false,"digest":{"function_hash":"47259525711348041565902279177697607383","length":1102},"id":"CVE-2024-29187-1f872115","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"340266194615075083893627448409834563310","length":1485},"id":"CVE-2024-29187-28493861","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9","target":{"file":"src/burn/engine/cache.cpp","function":"CalculateWorkingFolder"}},{"target":{"function":"CacheCleanup","file":"src/burn/engine/cache.cpp"},"deprecated":false,"digest":{"function_hash":"332750566491367916361833748385377497222","length":1158},"id":"CVE-2024-29187-2a13d12e","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9"},{"id":"CVE-2024-29187-2b1f9d34","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9","target":{"file":"src/burn/engine/cache.cpp","function":"CacheCalculatePayloadWorkingPath"},"deprecated":false,"digest":{"function_hash":"185142950193333352027476575934727011891","length":333}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/cache.h"},"deprecated":false,"digest":{"line_hashes":["160909976873952733855399776313397378327","200377720884205141905924073579025551166","251270509786953627404786752566553715116","320371291959197716465198928447437586718","265717895713321994776298517746111854283","266289963753848091130790912631745352413","227424402785390197468141460753708934770","118310879372117008312515400609083061956","131880705745306466459626946500895569574","38282797751965911918611996801405581254","208612850393710901817352691868279631974","10604737475925603835265373456310385093","11741083759650538040206898721688882144"],"threshold":0.9},"id":"CVE-2024-29187-366d9dbc"},{"deprecated":false,"digest":{"line_hashes":["79561429554931100307390049803652193843","331545621934180822898520714188806351859","36423555912110565040174149143142737922","69744607253668419934621098747298612524","278138078050736414879637710315915415612","278517603974526672066095163766414715720","226984553317089780071209102788780338934","54593958975188589205139192651096087055"],"threshold":0.9},"id":"CVE-2024-29187-38a0850e","signature_type":"Line","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/userexperience.cpp"}},{"digest":{"function_hash":"258876850588292266865721126203142149277","length":595},"id":"CVE-2024-29187-3f3666a6","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/cache.cpp","function":"CacheBundleToWorkingDirectory"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9","target":{"file":"src/burn/engine/cache.cpp","function":"CacheEnsureWorkingFolder"},"deprecated":false,"digest":{"function_hash":"106842496315161641130615712639559684240","length":461},"id":"CVE-2024-29187-48d653e8","signature_type":"Function"},{"id":"CVE-2024-29187-4f73dae8","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/core.cpp","function":"CoreApply"},"deprecated":false,"digest":{"function_hash":"137138100560226288196091951053998630349","length":4980}},{"source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/core.cpp","function":"CoreElevate"},"deprecated":false,"digest":{"length":1003,"function_hash":"213014224726596342492081341128951750146"},"id":"CVE-2024-29187-5b1bdc82","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9","target":{"file":"src/DTF/Tools/SfxCA/SfxUtil.cpp"},"deprecated":false,"digest":{"line_hashes":["138589889034004959039074746965733431920","273065920128931785481456685477379759514","129607533145724539058686077071746692073","317292233388770139879966992489409492436","102712174499057577731811194477877228603","267983879099650328771382981579685742224","157967919419245382688841572820636511310","28440616103203930052877429125661649562","184403827264819081966150908372591108756","90175340336907662144533283231485920508","101449018367219547422254586881881347096","41046908756230793908048463967803047034","325588912788884522433752980139559079447","49904420592163523352071421917943530292","120197086023904526953049263198608791169","102468877046887708400931546074182583772","239185778793067184476737222272633119397","89538580196826601574895443744031317540","165027847616683430756979982528083720153","197832502559384664452165375141411170982","222236864401085711569713096652102956163","320983739930650470374147308301825142980","102712174499057577731811194477877228603","267983879099650328771382981579685742224","157967919419245382688841572820636511310","220215490724665153225539209662046994562","259868909851597477234414609725023570825","194083100080872542790834742333867488077","336929106343985600487748577303597601133","24546103449677322501142294989544838931","339075520764722545416452966268108166962"],"threshold":0.9},"id":"CVE-2024-29187-5b50564b","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"305090836655556377709316903685877376713","length":1686},"id":"CVE-2024-29187-6afd27b8","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/engine.cpp","function":"RunUntrusted"}},{"target":{"file":"src/burn/engine/core.cpp"},"deprecated":false,"digest":{"line_hashes":["293395306276739820564354894154344670567","152291969398428971739984642307280915632","325321494717040487028288499606860753741","285120787877555415107500523328938125105","204043414084620827388399629717940145433","296403017690569788985016362740016650120","222646865889213947659293600571952510358","282965404936409877207109029035427600477","33476432649661989085636732035915899152","207522977561278543638874227017081715245","217993845492322872452387145528406999329","191327978891015290308455821460193778266","33476432649661989085636732035915899152","207522977561278543638874227017081715245","303634260364474415050288179951477845096","61616709028955683953107593453281395703","88098028249329871307136386936790342464","193576580616128725157738036571038761716"],"threshold":0.9},"id":"CVE-2024-29187-769ea481","signature_type":"Line","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7"},{"id":"CVE-2024-29187-909fbf04","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/cache.cpp","function":"CacheBundleToCleanRoom"},"deprecated":false,"digest":{"function_hash":"228863230524790962931287604365884148671","length":466}},{"deprecated":false,"digest":{"line_hashes":["92361452980478391833467789973203263251","104410552516329220196951313521950417910","271421257650582771222996444079416102547","247735855135873838013832283579039668057","180088132813687252819820774745096982361","75493973492205224611862447361451998048","284539301096309036256229236843142837543","216099941096355696427697727134664308345","221071374673634211929369738274246553713","215411060842456594509119392171988302339","294028912305438395013017692273767143554","315317128671316752106227457162659693595","11051479469699333359591765414863630457","174143299866324669726980388368049190270","201233766611044237634046477485556896624","145448508017239669150295686905824661462","224546677125086284175989068358295860417","235193790997454716956934502145722936307","161331324156963907077794137443935316479","327843383641867464237645903452593646054","311688413865614337654273853963149591864","184701777212136730029350719784988950968","167464637048890891968897617724332910556","197910388031761192073918166539582479377","142806433991214383279228975413725704089","173665914152033757493436170648614631105","177462226281143723591035959188814301776","8661771659325225762056297484101370061","329115855130663400251195592150092289640","248111609458064066647730921355102903003","147455454989687467992179155179877944879","94097680480269277432841660531209304958","82100890890006887779398910280022772600","8038144547134594828385152195432198059","145744178783613847093770175687822514689","211885586876078341398193133565687888289","185405925372956297731295617210509151889","128777598472438658369448896970016362","212534946683479022224242205801550924199","99587626251400202345708453835229040880","147999993036720932738294299138422776864","118870294659819266072309676548872674581","259289176950576499527997656177642494216","247735855135873838013832283579039668057","333078071578934003420237731380776481727","78066357820842974752215557154592152190","176938715743761155522554813563044998427","40162553409241963608386044071193033616"],"threshold":0.9},"id":"CVE-2024-29187-977ce564","signature_type":"Line","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/cache.cpp"}},{"deprecated":false,"digest":{"function_hash":"156234240360662120608397870394371312834","length":572},"id":"CVE-2024-29187-984a8383","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9","target":{"file":"src/burn/engine/cache.cpp","function":"CacheCalculateBundleWorkingPath"}},{"id":"CVE-2024-29187-9d515489","signature_type":"Line","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/userexperience.h"},"deprecated":false,"digest":{"line_hashes":["26619429402343242488294107604485858299","322238232617212868858817387995042127148","27720323766029319923637636163358778666","100081493242300807808546312778603421280"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"44566117595778143836416886006006033376","length":965},"id":"CVE-2024-29187-b4846976","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/cache.cpp","function":"CacheEnsureBaseWorkingFolder"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9","target":{"file":"src/burn/engine/cache.cpp","function":"CacheCalculateBundleLayoutWorkingPath"},"deprecated":false,"digest":{"function_hash":"137612245589009464393310386287694153942","length":355},"id":"CVE-2024-29187-c070c775"},{"deprecated":false,"digest":{"function_hash":"199569106291625633375771738223018603571","length":410},"id":"CVE-2024-29187-c13b5db7","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9","target":{"file":"src/burn/engine/cache.cpp","function":"CacheRemoveWorkingFolder"}},{"source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/dtf/SfxCA/SfxUtil.cpp"},"deprecated":false,"digest":{"line_hashes":["138589889034004959039074746965733431920","273065920128931785481456685477379759514","129607533145724539058686077071746692073","317292233388770139879966992489409492436","102712174499057577731811194477877228603","267983879099650328771382981579685742224","157967919419245382688841572820636511310","28440616103203930052877429125661649562","184403827264819081966150908372591108756","90175340336907662144533283231485920508","101449018367219547422254586881881347096","41046908756230793908048463967803047034","325588912788884522433752980139559079447","49904420592163523352071421917943530292","120197086023904526953049263198608791169","102468877046887708400931546074182583772","239185778793067184476737222272633119397","89538580196826601574895443744031317540","165027847616683430756979982528083720153","197832502559384664452165375141411170982","222236864401085711569713096652102956163","320983739930650470374147308301825142980","102712174499057577731811194477877228603","267983879099650328771382981579685742224","157967919419245382688841572820636511310","220215490724665153225539209662046994562","259868909851597477234414609725023570825","194083100080872542790834742333867488077","336929106343985600487748577303597601133","24546103449677322501142294989544838931","339075520764722545416452966268108166962"],"threshold":0.9},"id":"CVE-2024-29187-c4f061da","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/burn/engine/engine.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["64969508214235412555116346031980112216","221826481445747528860164177207180229754","166924693749724103301396717251294666565","180964304486779404834248256526620751190"]},"id":"CVE-2024-29187-db4eff26","signature_type":"Line","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7"},{"deprecated":false,"digest":{"length":488,"function_hash":"147433966425699218455145877271287371434"},"id":"CVE-2024-29187-ef97bde5","signature_type":"Function","signature_version":"v1","source":"https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","target":{"file":"src/burn/engine/userexperience.cpp","function":"UserExperienceEnsureWorkingFolder"}},{"signature_version":"v1","source":"https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9","target":{"file":"src/burn/engine/cache.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["164255742290017238417711471762983890565","127728712685024599802650030028166986695","273250483954565673446641875869575769097","41123299308946586214242069929671370269","247095852997400704743747906697144086840","318253861481343172132476513837321717377","271791965300873548218341948701903330780","8163861472952234337444166035548684645","330341900701394964365409741852927591894","112415343987694710893569467088770415632","213206154218534295201810684806545242143","97379755978491413606773106794253293192","237709672462439285619953806937804219302","63163109689680760277999856663467061236","90932146169497333412019539166954192130","281352325300975834464872852402057314788","210058560100590456995183491149286422361","166513799590850014089302330196164379732","191579976828952752756918443230300974081","193146114186714359436023536194546124509","21446840742175423309218516461758147343","122619636070531742514266353536915542411","160345906484544352683587302559211328754","276008026482134045995090164492766004562","153033855361402224690716526199105010232","235750600937670266955525708131335682398","145998651080637305529676735309063635467","288590767127137518618013173078283347251","216249474051330328724508814228290435655","328391675846361139701672872509623479510","207887283475275714781354623379181885805","322144317953293969917095791552844288592","292559383270608884650435907809563882771","328391675846361139701672872509623479510","42609025956244180705454846749189479197","305317396569660590466983123491580465509","241453969043996552930871261122100662223","328016761004683299905635348420561181345","57947453359256929303581380841157983220","265647526227669191260509224507027126541","201479780005736552697620102235294454108","99609503360704438619629429179243809336","146943685578380988358392120405994263736","106419991848522315797604434467696188392","330496094919543478512394165563182492916","1156020371330748918627038731648909807","172213510352363116167246353154111426381","176460785106268590063084460011866549962","1837944023439606777183573196870230631","259539890258483849342756855199036934419","111520082106540940033750295715925728298","213809543140442373679686840059882303736","13236277284379097590567196087451195729","39644097336697635946215032601961408869","315324335040578687941172074883699615657","58769741659950321576784486829083835351"]},"id":"CVE-2024-29187-f712a8b2","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}