Local Privilege Escalation in MyReport Updater via DLL Hijacking

MyReport Updater through version 2.1.1 contains a local privilege escalation (LPE) vulnerability (CVE-2026-110633) stemming from insecure gRPC communication handled by the UpdaterManager.exe service. This service, which runs with SYSTEM privileges, fails to properly validate the reference server and installLocation parameters provided by users over the gRPC interface. An unprivileged attacker can exploit this flaw to instruct the service to download and extract a malicious archive into an arbitrary filesystem directory. By specifying an install location that enables DLL hijacking, the attacker can place a malicious version of HID.dll such that it is subsequently loaded by the On-Screen Keyboard process (osk.exe) when it initiates under a SYSTEM context. This allows the attacker to transition from a low-privileged user account to full system-level access.

Impact

Successful exploitation allows a local user to gain SYSTEM privileges on the affected host. This vulnerability has a CVSS v3.1 base score of 7.8, representing a significant risk in multi-user or shared workstation environments where MyReport Updater is deployed. Organizations using versions 2.1.1 and earlier are at risk of complete system compromise if an unprivileged user gains local access to the system.

Recommendation

• Upgrade all instances of MyReport Updater to a version beyond 2.1.1 immediately.
• Monitor for unauthorized gRPC communication directed at UpdaterManager.exe from non-privileged user accounts.
• Audit filesystem permissions on critical directories to prevent local users from writing DLLs to paths where system processes load dependencies.
• Use EDR/Sysmon telemetry to baseline legitimate dependency loading for system binaries like osk.exe.