CVE-2026-110716: Out-of-bounds Read in twogood unshield
Description
unshield versions up to and including 1.6.2 contain a heap out-of-bounds read vulnerability in the unshield_get_file_table() function. This flaw allows attackers to read beyond allocated heap memory by supplying crafted InstallShield cabinet files with invalid header offsets or large file counts. The vulnerability can cause crashes in the unshield tool or any software using its library.
CVSS v4.0
Score 6.8medium
Affected software
twogood
unshield
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-110716 is a heap out-of-bounds read vulnerability in unshield through version 1.6.2. The issue resides in the unshield_get_file_table() function, where unchecked cabinet header offsets allow an attacker to read past heap allocations. By providing a maliciously crafted InstallShield cabinet file with out-of-range file_table_offset or an excessively large number of files, an attacker can trigger a crash in unshield or any consumer of its library.
Potential Impact
Successful exploitation can lead to application crashes due to reading beyond allocated heap memory. This may result in denial of service for users of the unshield tool or applications relying on its library. There is no indication from the data that this vulnerability allows code execution or data corruption beyond the out-of-bounds read.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted InstallShield cabinet files with unshield to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-14T14:39:53.359Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acfa0f92cdf04f65690568a
Added to database: 10/14/2026, 15:34:17 UTC
Last enriched: 10/14/2026, 15:49:22 UTC
Last updated: 10/14/2026, 19:00:32 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.