The vulnerability is a heap out‑of‑bounds read in the function that retrieves the file table from an InstallShield cabinet. When the function processes an intentionally crafted cabinet file, unchecked numerical values can cause the code to read beyond the allocated memory, potentially exposing arbitrary data on the heap. This memory read may leak sensitive information or be used to crash or destabilize the unshield tool or any software that links to the library. The weakness is classified as CWE‑125, an out‑of‑bounds read condition.

The affected product is the open‑source unshield utility from the twogood project, specifically all releases up to and including version 1.6.2. Any system that uses the binary or links against the library within that version range is vulnerable.

With a CVSS score of 6.8, the vulnerability is considered moderate. The EPSS score is < 1%, indicating low exploitation likelihood, and the issue is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation at present. Exploitation requires an attacker to supply a malicious cabinet file that contains an out‑of‑range file_table_offset or a very large file count. The malicious file can then be processed by an unsuspecting user or a system that processes InstallShield cabinets, resulting in memory disclosure or a crash. The attack vector is an untrusted file input to unshield or a consuming application.