A vulnerability was detected in InnoSetup Installer 5.5.9. This affects an unknown part. The manipulation results in uncontrolled search path. The attack can be executed remotely. The exploit is now public and may be used. This is a malformed-PE / self-extracting-installer defect report that the vendor never acknowledged.
This CVE has been withdrawn by MITRE
MITRE marked CVE-2017-20051 as REJECTED on . It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.
Reason given by MITRE
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The sole source documents PE-format conformance defects in innosetup-5.5.9.exe with no exploit, attack path, or untrusted search path condition (CWE-426/427), and the author states Windows loads these files normally; the record's remote/exploited claims are unsupported, as is the product maintainer's contention.
CVE-2017-20051
✕ Withdrawn — historical dataHIGHNVD 7.8
7.8CVSS
- CVSS v3
- 7.8
- EchelonGraph score
- Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
- EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- —Not applicable: this CVE ID was withdrawn
Published
June 16, 2022
Last Modified
September 29, 2026
References (5)
- cna@vuldb · CVE Programhttp://seclists.org/fulldisclosure/2017/Mar/8
- cna@vuldbhttps://vuldb.com/cve/CVE-2017-20051
- cna@vuldbhttps://vuldb.com/vuln/97837
- cna@vuldbhttps://vuldb.com/vuln/97837/cti
- CVE Programhttps://vuldb.com/?id.97837
Frequently asked(4)
What is CVE-2017-20051?
CVE-2017-20051 is a rejected CVE ID: its record was withdrawn on September 30, 2026 and no longer describes a vulnerability. Reason given: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The sole source documents PE-format conformance defects in innosetup-5.5.9.exe with no exploit, attack path, or untrusted search path condition (CWE-426/427), and the author states Windows loads these files normally; the record's remote/exploited claims are unsupported, as is the product maintainer's contention.
When was the CVE record for CVE-2017-20051 published?
The CVE record for CVE-2017-20051 was published on June 16, 2022. EchelonGraph's copy of the record carries a last-modified date of September 29, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2017-20051?
CVE-2017-20051 has a CVSS v3 base score of 7.8 (NVD).
How do I remediate CVE-2017-20051?
There is nothing to remediate under CVE-2017-20051: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.