Inno Setup, a classic Windows application installer creation tool, released a major update version of “Inno Setup 7” on July 13, 2026. This update marks the first major overhaul in about seven years since 2019, featuring changes that significantly impact both developers and users, such as 64-bit native support to adapt to modern computing environments and the removal of long-standing path length constraints.

Major overhaul after 7 years and 64-bit native support

One of the de facto standards for Windows installer creation software, “Inno Setup,” received its long-awaited major update as version 7.0.2 on July 13, 2026. The biggest highlight of this update is the addition of a new 64-bit (x64) version, moving away from the traditional 32-bit environment design. The developer strongly recommends this 64-bit version for future use. This is expected to improve tool stability and performance in modern applications that utilize vast memory spaces and development environments involving more complex build processes.

At the same time, compatibility considerations are thoroughly considered. The traditional 32-bit (x86) version is still available, designed to facilitate smooth migration of existing projects. Notably, even when using the 64-bit version of Inno Setup, you can create installers compatible with both 32-bit and 64-bit versions. It is also possible to coexist in the same environment as the older version of “Inno Setup 6,” allowing developers to gradually migrate to the new version while maintaining existing assets. In this way, an update that balances convenience and compatibility is highly meaningful for many developers who have used this tool for many years. The diagram below shows the standard wizard screen of the new version.

Removal of MAX_PATH restrictions and freedom of development

One of the most welcome improvements from developers in “Inno Setup 7” is the removal of restrictions on the maximum file path length (MAX_PATH). By removing the long-standing 260-character path barrier in Windows history, it has become dramatically easier to create installers for large-scale software with deep directory structures and applications that bundle complex libraries. Until now, there was a risk of unexpected errors caused by an installation path that was too long, forcing developers to take workarounds such as shortening file names or simplifying structures.

The removal of the 260-character limit this time will be especially effective for distributing software that handles complex enterprise systems, game development with vast assets, and even massive data structures like AI models. Additionally, it supports Windows 7 and later operating systems, and the editorial team has confirmed that it runs stably even in the latest Windows 11 environments. While maintaining its traditional strength of advanced customization using Pascal scripts, the removal of these modern constraints has allowed Inno Setup to evolve from a “dry tool” into a “modern tool that meets next-generation demands.”

Growing Security Threats and the Role of Installers

Lessons Learned and Remediated from CVE-2025-15595

Because installers are tools involving deep system privileges, their vulnerabilities pose extremely serious risks. Inno Setup also has a lesson from a serious vulnerability called “CVE-2025-15595,” which was disclosed in March 2026. This means that in installers created with Inno Setup prior to version 6.2.1, privilege escalation via DLL hijacking was possible. This vulnerability was also detailed in the NVD (National Vulnerability Database) of NIST (National Institute of Standards and Technology), where it was rated as “HIGH” with a CVSS v3.1 score of 7.8.

Specifically, there was a risk that unauthenticated local attackers could place specific DLL files and execute arbitrary code with high privileges during installer runtime. This issue was fixed in version 6.2.2 and later, and naturally, the countermeasures are carried over to “Inno Setup 7.” Continuing to use older versions of tools means embedding vulnerabilities in the software they distribute themselves, which can put end users at risk. Therefore, updating to the latest version is not just about adding features, but has become essential to ensure the safety of the entire supply chain. The diagram below shows the conceptual flow when vulnerabilities are exploited.

A sophisticated installer technique exploited by malware

Unfortunately, Inno Setup’s convenience and recognition make it attractive to attackers as well. According to a report by security vendor AhnLab, there have been numerous cases where malware disguised as security update installers is being created using Inno Setup. These are called “InnoLoaders,” which at first glance display a legitimate software installation screen, but when the user clicks the “Next” button to proceed, they start stealing system information or downloading additional malware (such as StealC and Lu0Bot) in the background.

A particularly clever technique is to regenerate the program so that the hash value changes every time it is downloaded. This makes it difficult for signature-based antivirus software to detect them. Additionally, advanced evasion techniques are incorporated, such as not engaging in fraudulent behavior unless a response from a specific C2 server is “OK,” or detecting virtual environments or debuggers to alter their behavior. Because the installer itself is built with legitimate tools, users tend to run it without suspicion. Developers are more responsible than ever for distributing signed official packages, and users are required to have literacy to avoid easy downloads from sources other than official sites.

Attacks Targeting Specific Industries and Future Security

The threat of installer phishing hitting the automotive industry

The impact of supply chain attacks via installers extends beyond the IT industry to manufacturing sites such as the automotive sector. A VicOne research report reported cases where engineering tools such as the “CAN viewer,” used for automotive design and diagnostics, were infiltrated with malware called RedLine Stealer, which steals information. These malicious tools are packaged in Inno Setup, and since they may appear to have legitimate signatures on the surface, there is a risk that on-site technicians will install them without suspicion as part of their routine work.

If a developer’s workstation is compromised by such tools, there is a risk that Git credentials and code signing certificates could be stolen. If this becomes reality, it is not even possible that “unauthorized firmware” signed in the organization’s official name could be created, and through OTA (Over-The-Air) updates, malicious code could eventually reach the vehicles in transit. In this way, the installer, a single entry point, can become a critical blind spot that threatens the security of the entire industry. The importance of thorough verification and monitoring of every utility used in development environments has become underpinpointed.

Future Outlook and Expectations for IT Modernization

From 2026 onward, the IT industry will enter an era called “Modernization 2.0,” where AI-driven autonomy and enhanced resilience are required. As systems become more complex and vulnerabilities are discovered daily, installer creation tools are also shifting from mere “file deployment machines” to “foundations for building secure environments.” The 64-bit transition and removal of constraints demonstrated by Inno Setup 7 form the foundation supporting the construction of such advanced systems. Going forward, the spread of “self-healing IT,” where AI automatically detects and fixes source code vulnerabilities, is also anticipated, and the use of such AI agents in installer creation processes is expected to accelerate.

On the other hand, as pointed out by organizations such as JNSA (Japan Network Security Association), the issue of vulnerability responsibility in contract development is now under strict legal scrutiny. Since the 2014 Tokyo District Court ruling, the recognition that vulnerability countermeasures are a “duty of care as an expert” has become established. Adopting cutting-edge tools like Inno Setup 7 is part of the technical integrity developers must uphold. Going forward, based on zero trust principles, the process of “verifying before trusting” all binaries and installers will be standardized. Development speed brought by reliable tools and safety through thorough verification. These two pillars will be the key supporting the future of the software industry.

Reference Page

• [Inno Setup Official Site]https://jrsoftware.org/isinfo.php

• 【GitHub – jrsoftware/issrc】https://github.com/jrsoftware/issrc

• 【CVE-2025-15595 Detail – NVD】https://nvd.nist.gov/vuln/detail/CVE-2025-15595

[#InnoSetup #Windowsインストーラー #サイバーセキュリティ #脆弱性対策 #開発ツール #サプライチェーン攻撃 #ITモダナイゼーション]