InstallShield CVE-2026-4869

Requires a compressed Basic MSI setup authored with InstallShield 2025 R2 or earlier that bundles Prerequisites, where the resulting Setup.exe is launched from an insecure/unsecured (e.g. world-writable) directory. The attacker must be able to write a malicious Prerequisite installer into that directory beforehand, and a local administrator must then actively launch the compressed Setup.exe from that location (UI:A), causing the Prerequisite installers to load from the attacker-controlled path. Limiting factors: exploitation is strictly local (not remote), depends on the non-default and poor-hygiene choice of running setup from a writable location, requires the attacker to already hold local access to plant files, and requires an administrator to perform the launch - only compressed setups that include Prerequisites are affected.

This is a medium-severity local privilege escalation (CVSS 4.0 base 5.4, vector AV:L/AC:L/AT:P/PR:L/UI:A) categorized as CWE-426 (Untrusted Search Path). All signals point to a LOW real-world priority rather than an urgent threat: the only vector supplied is LOCAL (AV:L), exploitation carries an attack requirement (AT:P) meaning a specific non-default condition - launching a compressed Setup.exe with Prerequisites from an insecure/world-writable directory - must already exist, the attacker needs existing local privileges (PR:L), and active user interaction by an administrator is required (UI:A). No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no public exploit identified at time of analysis. The high impact metrics (VC:H/VI:H/VA:H) reflect that a successful escalation yields full control of the victim's elevated context, but the chain of preconditions sharply constrains likelihood. No signals conflict; rather they consistently indicate a genuine-but-situational weakness. Note the CVSS vector encodes AC:L while the description's dependence on an attacker-controlled insecure directory arguably implies higher complexity - this discrepancy is reflected in the independent assessment below. Treat as a hardening/patch-when-convenient item, not an emergency, absent evidence that vulnerable setups are distributed from writable locations in your environment.

A low-privileged local user plants a malicious Prerequisite installer (or a DLL/executable it will load) in an insecure, writable directory that also holds a compressed InstallShield Setup.exe. When a local administrator later launches that Setup.exe from the same unsecured location, the bundled Prerequisite installer is loaded from the attacker-controlled path and executes with the administrator's elevated privileges. No public exploit code is identified for this specific CVE, but the untrusted-search-path pattern is well understood and straightforward to weaponize once the preconditions exist.