{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-110633/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:myreport:updater:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-110633"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MyReport Updater (\u003c= 2.1.1)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","lpe","cve-2026-110633"],"_cs_type":"advisory","_cs_vendors":["MyReport"],"content_html":"\u003cp\u003eMyReport Updater through version 2.1.1 contains a local privilege escalation (LPE) vulnerability (CVE-2026-110633) stemming from insecure gRPC communication handled by the UpdaterManager.exe service. This service, which runs with SYSTEM privileges, fails to properly validate the reference server and installLocation parameters provided by users over the gRPC interface. An unprivileged attacker can exploit this flaw to instruct the service to download and extract a malicious archive into an arbitrary filesystem directory. By specifying an install location that enables DLL hijacking, the attacker can place a malicious version of HID.dll such that it is subsequently loaded by the On-Screen Keyboard process (osk.exe) when it initiates under a SYSTEM context. This allows the attacker to transition from a low-privileged user account to full system-level access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a local user to gain SYSTEM privileges on the affected host. This vulnerability has a CVSS v3.1 base score of 7.8, representing a significant risk in multi-user or shared workstation environments where MyReport Updater is deployed. Organizations using versions 2.1.1 and earlier are at risk of complete system compromise if an unprivileged user gains local access to the system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of MyReport Updater to a version beyond 2.1.1 immediately.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized gRPC communication directed at UpdaterManager.exe from non-privileged user accounts.\u003c/li\u003e\n\u003cli\u003eAudit filesystem permissions on critical directories to prevent local users from writing DLLs to paths where system processes load dependencies.\u003c/li\u003e\n\u003cli\u003eUse EDR/Sysmon telemetry to baseline legitimate dependency loading for system binaries like osk.exe.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:37:30Z","date_published":"2026-10-14T16:37:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-myreport-updater-lpe/","summary":"MyReport Updater versions through 2.1.1 are vulnerable to local privilege escalation allowing low-privileged users to achieve SYSTEM execution via malicious DLL injection in osk.exe.","title":"Local Privilege Escalation in MyReport Updater via DLL Hijacking","url":"https://feed.craftedsignal.io/briefs/2026-10-myreport-updater-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-110633","version":"https://jsonfeed.org/version/1.1"}