The vulnerability arises from the execution of prerequisite installers from untrusted directories when a compressed Basic MSI setup is run. This allows an installer to load code from insecure locations, potentially providing a path for an attacker to elevate privileges. The weakness is classified as CWE‑426 (Untrusted Content), meaning that untrusted inputs could be executed. In a system where a local administrator starts the Setup.exe, the loaded prerequisites could gain higher privileges than the initiating user, compromising system security.

Flexera InstallShield 2025 R2 and all earlier releases are affected. The issue appears when compressed Basic MSI setups are run with prerequisites sourced from an insecure or non‑trusted directory. Users running these installers should verify the directory source.

The CVSS score of 5.4 indicates a moderate level of risk. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector, inferred from the description, requires a local administrator initiating the Setup.exe from a non‑trusted location. An attacker would need to supply a malicious prerequisite installer, which if accepted could lead to privilege escalation. Without a publicly known exploit, the current threat is limited, but the vulnerability should be addressed promptly.