Custom actions are installer routines that run extra code during setup, repair, or uninstall. They let software perform tasks that a plain file copy cannot, such as creating services, writing registry values, checking prerequisites, or launching helper processes. Because they are part of the installation workflow, they often run with elevated privileges, sometimes as Administrator or SYSTEM on Windows.
In security terms, custom actions matter because they sit inside a trusted execution path. If an attacker can influence the installer, replace a component, or abuse a repair operation, those actions may be used to run arbitrary code with higher privileges. Defenders watch for insecure installer design, restrict who can start installs or repairs, and patch products that expose unsafe custom actions. Good packaging and code signing reduce risk, but the safest approach is to treat installer logic as privileged code that must be tightly controlled and audited.