CVE-2026-110716
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range file_table_offset or large file counts to crash the unshield tool or library consumers.
Risk Assessment
A crafted cabinet file can crash the application processing archives, leading to denial of service or potential memory data leakage.
Recommendation
Upgrade unshield beyond version 1.6.2 or avoid processing untrusted cabinet files until a fix is released.
Other vulnerabilities in unshield
Original NVD description (English source)
unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range file_table_offset or large file counts to crash the unshield tool or library consumers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS