{"id":"CVE-2021-41526","aliases":["EUVD-2021-28545","GHSA-q4jw-3mfc-r879"],"status":"published","title":"A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom...","description":"A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privilege escalation when invoked ‘repair’ of the MSI which has an InstallScript custom action.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0028,"percentile":0.20678,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2023-03-29T00:00:00Z","modified":"2026-06-17T04:08:35Z","products":[{"vendor":"flexera","product":"revenera_installshield"}],"references":[{"url":"https://community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2021-41526-Privilege-escalation-vulnerability-during-MSI/ta-p/218137/jump-to/first-unread-message","tags":["x_transferred","Vendor Advisory"]},{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0011/MNDT-2021-0011.md","tags":["x_transferred","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2024/Apr/24","tags":["mailing-list","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41526"},{"url":"https://github.com/advisories/GHSA-q4jw-3mfc-r879"}],"sources":{"cve":[{"id":"CVE-2021-41526","description":"A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privilege escalation when invoked ‘repair’ of the MSI which has an InstallScript custom action.","status":"published","published":"2023-03-29T00:00:00Z","modified":"2024-08-04T03:15:28.449Z","updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2021-28545","description":"A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privilege escalation when invoked ‘repair’ of the MSI which has an InstallScript custom action.","status":"published","published":"2023-03-29T00:00:00Z","modified":"2024-08-04T03:15:28Z","updated_at":"2026-11-03T03:24:17.663217Z"}],"ghsa":[{"id":"GHSA-q4jw-3mfc-r879","title":"A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom...","description":"A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privilege escalation when invoked ‘repair’ of the MSI which has an InstallScript custom action.","status":"published","published":"2023-07-06T19:24:13Z","modified":"2024-04-19T15:30:46Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:57:13.502248Z"}],"nvd":[{"id":"CVE-2021-41526","description":"A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privilege escalation when invoked ‘repair’ of the MSI which has an InstallScript custom action.","status":"published","published":"2023-03-29T21:15:07.81Z","modified":"2026-06-17T04:08:35.53Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:07:07.764332Z"}]}}