{"id":"CVE-2026-110633","published":"2026-10-14T15:17:16.283","lastModified":"2026-10-16T19:18:44.867","description":"MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html","tags":[]},{"url":"https://www.myreport.fr/myreport/","tags":[]},{"url":"https://www.vulncheck.com/advisories/myreport-updater-through-2.1.1-local-privilege-escalation-via-updater-service","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}