CVE-2024-14012

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-29

Last updated on: 2025-10-30

Assigner: Flexera Software LLC

Description

Potential privilege escalation issue in Revenera InstallShield version 2023 R1 running a renamed Setup.exe on Windows. When a local administrator executes a renamed Setup.exe, the MPR.dll may get loaded from an insecure location and can result in a privilege escalation. The issue has been fixed in versions 2023 R2 and later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-29

Last Modified

2025-10-30

Generated

2026-07-06

AI Q&A

2025-10-29

EPSS Evaluated

2026-07-05

NVD

CVE-2024-14012

EUVD

EUVD-2024-55044

Affected Vendors & Products

Vendor	Product	Version / Range
revenera	installshield	2023_r1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-426	The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

Executive Summary

This vulnerability is a potential privilege escalation issue in Revenera InstallShield version 2023 R1 when running a renamed Setup.exe on Windows. If a local administrator executes the renamed Setup.exe, the MPR.dll may be loaded from an insecure location, which can lead to privilege escalation.

Impact Analysis

The vulnerability can allow a local administrator to escalate privileges by causing the system to load a malicious MPR.dll from an insecure location when running a renamed Setup.exe. This could lead to unauthorized elevated access and potentially compromise system security.

Mitigation Strategies

To mitigate this vulnerability, update Revenera InstallShield to version 2023 R2 or later. Avoid running a renamed Setup.exe as a local administrator until the update is applied.

Hi! I’m here to help you understand CVE-2024-14012. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70