CVE-2026-14208: Local Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0
Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities - Host\), granting FULL CONTROL (F) to the built-in Everyone group (BUILTIN\Everyone, S-1-1-0). A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this directory. The DLLs are file-locked at runtime, but a race window exists when the service is stopped (e.g. during a software update or following a crash), during which a local unprivileged attacker can replace a DLL with a malicious payload. Upon service restart, the payload executes as NT AUTHORITY\SYSTEM. The DLL confirmed as actively loaded during testing is libasset32.dll. Additional DLLs in the same directory (eventmsg.dll, libcodec32.dll, vp8encoder.dll, vp8decoder.dll, webmvorbisdecoder.dll, webmvorbisencoder.dll, webmmux.dll) share identical insecure permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Recursively enforce NTFS permissions on all DLL files under C:\Program Files (x86)\Remote Utilities - Host\ during installer, update routine, and repair mechanism: remove ACL entry Everyone:(F) (BUILTIN\Everyone, S-1-1-0) and set permissions to SYSTEM (Full Control), Administrators (Full Control), and Users/Authenticated Users (Read & Execute).
Remote Utilities Host installation directory DLLs (C:\Program Files (x86)\Remote Utilities - Host\) NTFS ACL on DLL files (recursive) = Remove Everyone:(F) and set: SYSTEM: Full Control; Administrators: Full Control; Users/Authenticated Users: Read & Execute - Configuration
Implement cryptographic signature verification of all loaded DLLs at service startup so unsigned/tampered DLLs cannot be loaded when the service runs as NT AUTHORITY\SYSTEM.
Remote Utilities Host service startup DLL signature verification = Enable cryptographic signature verification for all loaded DLLs - Configuration
Use atomic DLL replacement during updates: write updated DLLs to a temporary path, verify the DLL signature, then rename to replace the existing DLL to eliminate the stop/restart race window.
Remote Utilities Host update routine DLL update method = Atomic DLL replacement: write to temp path -> verify signature -> rename
Event History
Frequently Asked Questions
Who can exploit this issue?
An unprivileged local Windows user can exploit it. The attacker must be able to write to the Remote Utilities Host installation directory, which is possible because the listed DLLs grant FULL CONTROL to the Everyone group.
What conditions are required for successful exploitation?
The Remote Utilities Host service must stop or otherwise release its DLL file locks, such as during a software update or after a crash. The attacker can then replace a DLL, and the service must restart and load the malicious replacement.
Which files should be checked for insecure permissions?
Check DLL ACLs in C:\Program Files (x86)\Remote Utilities - Host\, particularly libasset32.dll, which was confirmed as actively loaded. The same insecure permissions were also identified on eventmsg.dll, libcodec32.dll, vp8encoder.dll, vp8decoder.dll, webmvorbisdecoder.dll, webmvorbisencoder.dll, and webmmux.dll.
How can exposure be reduced if patching cannot happen immediately?
Remove write access for the Everyone group from DLLs in the Host installation directory so unprivileged users cannot replace them. Restrict local unprivileged access to affected systems and monitor or control Host service stops and restarts, since the replacement opportunity occurs while the service is stopped.