high7.8
CVE-2026-110633
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install …
Impact
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| MyReport | MyReport Updater | through 2.1.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.