CVE-2026-4869: Potential Privilege Escalation in InstallShield
A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches a compressed Setup.exe with Prerequisites from an unsecured location, the Prerequisite installers also might load from an unsecured location, potentially leading to privilege escalation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed when a local administrator runs a compressed Basic MSI Setup.exe that uses Prerequisites from an unsecured location. The issue applies to InstallShield 2025 R2 and earlier.
What must an attacker be able to do to exploit it?
An attacker would need the prerequisite installers to be available from, or loadable through, an unsecured location when the administrator launches the compressed setup. The provided information does not describe a remote attack path.
Are all InstallShield installers affected?
No. The described condition is limited to compressed Basic MSI setups that include Prerequisites and are run from an insecure location. Other installer types or setups without those conditions are not identified as affected.
What can be done if updating is not immediately possible?
Do not run affected compressed Setup.exe packages from unsecured locations. Store and launch the setup and its prerequisite installers only from secured locations, especially when installation is performed by a local administrator.