unshield CVE-2026-110716

Exploitation requires an attacker-supplied, crafted InstallShield cabinet file containing an out-of-range file_table_offset or an abnormally large file count, which must then be parsed by the unshield command-line tool or an application linking libunshield - i.e., the victim or an automated pipeline must actively process the malicious file (UI:P / local vector). Limiting factors: no remote network vector (AV:L), the attack cannot be triggered without the target processing the file, and the realistic impact is confined to a crash/denial of service (VA:H; VC:N/VI:N) rather than code execution or data theft. Affects unshield versions up to and including 1.6.2.

This is a medium-severity (CVSS 4.0 base 6.8) memory-safety defect whose real-world risk is modest. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) describes a local, low-complexity flaw that requires passive user interaction and yields only an availability impact (a crash) - there is no confidentiality or integrity impact per the vector. Publicly available exploit code exists (referenced VulnCheck advisory and a hackmd write-up), which raises the chance of opportunistic reproduction, but there is NO CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. SSVC-style reasoning points to low priority: exploitation is file/consumer-triggered rather than automatable at scale, and technical impact is limited to denial of service of the unshield tool or a library consumer. One signal conflict to verify: the 'Information Disclosure' tag and the CWE-125 out-of-bounds READ nature suggest potential memory disclosure, yet the authoritative CVSS 4.0 vector sets VC:N (no confidentiality impact) and VA:H - i.e., the demonstrated impact is a crash, not data leakage; treat any info-disclosure claim as unconfirmed and verify with the VulnCheck advisory.

An attacker crafts a malicious InstallShield cabinet file with an out-of-range file_table_offset or an inflated file count and gets a victim to process it with the unshield tool or an application that embeds libunshield. When unshield_get_file_table() parses the attacker-controlled header, it reads past the heap allocation and crashes the process. Publicly available proof-of-concept exploit code demonstrates the heap out-of-bounds read.