Inno Setup Privilege Escalation Vulnerability via DLL Hijacking

A privilege escalation vulnerability has been identified in Inno Setup versions through 6.2.1, allowing for DLL hijacking. This issue arises when installers or uninstallers are executed under the SYSTEM account, creating a potential vector for malicious DLLs to be loaded and executed, thereby escalating privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation by allowing a user to execute code with elevated rights.

Remediation

Users can update to Inno Setup version 6.2.2 or later, which includes improvements to protect against potential DLL preloading attacks when running installers or uninstallers under the SYSTEM account.