CVEvulnerability

CVE-2021-41526

7.8 HIGH Published 2023-03-29 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2023-03-29
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privilege escalation when invoked ‘repair’ of the MSI which has an InstallScript custom action.

Affected configurations

• flexera revenera installshield (< 2021) • flexera revenera installshield 2021

References

http://seclists.org/fulldisclosure/2024/Apr/24 seclists.org
https://community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2021-41526-Privilege-escalation-vulnerability-during-MSI/ta-p/218137/jump-to/first-unread-message Vendor Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0011/MNDT-2021-0011.md Third Party Advisory
http://seclists.org/fulldisclosure/2024/Apr/24 seclists.org
https://community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2021-41526-Privilege-escalation-vulnerability-during-MSI/ta-p/218137/jump-to/first-unread-message Vendor Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0011/MNDT-2021-0011.md Third Party Advisory