CVE-2025-12418 Potential Denial of Service in Supported Versions of Revenera InstallShield
A local administrator uninstalling Revenera InstallShield may trigger a denial of service via symlink following in a user-writable directory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-12418?
CVE-2025-12418 is a medium-severity path traversal vulnerability in Revenera InstallShield, published on 7 Nov 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Potential Denial of Service issue in all supported versions of Revenera InstallShield version 2025 R1, 2024 R2, 2023 R2, and prior. When e.g., a local administrator performs an uninstall, a symlink may get followed on removal of a user writeable configuration directory and induce a Denial of Service as a result. The issue is resolved through the hotfixes InstallShield2025R1-CVE-2025-12418-SecurityPatch, InstallShield2024R2-CVE-2025-12418-SecurityPatch, and InstallShield2023R2-CVE-2025-12418-SecurityPatch.
Weakness: CWE-59
Which versions are affected by CVE-2025-12418?
How do I fix CVE-2025-12418?
No fix has been published for CVE-2025-12418 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-12418 being exploited?
There is no known exploitation of CVE-2025-12418 in the wild and no public exploit code.
Sources
Also known as GHSA-frcm-hvx7-5p9q.