CVE-2016-2542
Untrusted search path vulnerability in Flexera InstallShield through 2015 SP1 allows local users...
CVE-2016-2542 is a high vulnerability (CVSS 7.8) in Flexera Installshield, published February 24, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. No source names a fixed version.
Untrusted search path vulnerability in Flexera InstallShield through 2015 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory of a setup-launcher executable file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Untrusted search path vulnerability in Flexera InstallShield through 2015 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory of a setup-launcher executable file.
- Record
CVE-2016-2542- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Untrusted search path vulnerability in Flexera InstallShield through 2015 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory of a setup-launcher executable file.
- Record
CVE-2016-2542- Updated
- 2026-11-02
EUVDEUVD-2016-3618 No score
Untrusted search path vulnerability in Flexera InstallShield through 2015 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory of a setup-launcher executable file.
- Record
EUVD-2016-3618- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f59c-93qc-8672
Untrusted search path vulnerability in Flexera InstallShield through 2015 SP1 allows local users...
Untrusted search path vulnerability in Flexera InstallShield through 2015 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory of a setup-launcher executable file.
- Record
GHSA-f59c-93qc-8672- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
securitytracker.com/id/1035097
securityfocus.com/bid/84213
tenable.com/security/tns-2019-08
oracle.com/security-alerts/cpuApr2021.html
flexeracommunity.force.com/customer/articles/INFO/Best-Practices-to-Avoid-Windows-Setup-Launcher-Executable-Issues
us-cert.cisa.gov/ics/advisories/icsa-20-287-03
nvd.nist.gov/vuln/detail/CVE-2016-2542
github.com/advisories/GHSA-f59c-93qc-8672