CVE-2026-110633: MyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged local user can exploit it. The attack requires access to the affected system and does not require user interaction.
What access does an attacker need to gain SYSTEM privileges?
The attacker needs to run UpdaterManager.exe and communicate with the updater service over gRPC. They can set a malicious reference server and an installLocation that causes attacker-supplied archives to be installed in arbitrary directories.
How does exploitation result in SYSTEM-level execution?
An attacker can plant a DLL such as HID.dll in a location from which osk.exe loads it. Because the updater service runs as SYSTEM, this DLL planting can be used to obtain SYSTEM privileges.