CVE-2023-29080: Revenera Installshield

High severity, CVSS 8.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Potential privilege escalation vulnerability in Revenera InstallShield versions 2022 R2 and 2021 R2 due to adding InstallScript custom action to a Basic MSI or InstallScript MSI project extracting few binaries to a predefined writable folder during installation time. The standard user account has write access to these files and folders, hence replacing them during installation time can lead to a DLL hijacking vulnerability.

Affected products

• Revenera Installshield: from 2022 R2, before 2022 R2 (28.0.0.763) (fixed in 2022 R2 (28.0.0.763)); from 2021 R2, before 2021 R2 (27.0.0.126) (fixed in 2021 R2 (27.0.0.126))

Published 2025-01-30. Last modified 2026-06-17.