Hyland Desktop Host CVE-2026-110359

Exploitation requires an existing low-privileged local account (or local code execution) on a Windows host where Hyland Desktop Host prior to 25.1.1 is installed and its privileged service runs from %PROGRAMDATA%\Hyland\DesktopHost\bin with weak (non-administrator-writable) filesystem permissions. The attacker must be able to write to that service directory and must be able to cause the privileged service to (re)start to load the planted code. Limiting factors: this is local-only (no network/remote path, per AV:L), needs some pre-existing low privilege (PR:L), and is only meaningful on multi-user or shared hosts - single-admin workstations where only trusted users have local access present little practical exposure. Default installations are affected to the extent they ship the weak directory ACLs.

This is a credible, actionable local privilege escalation issue rather than a high-CVSS-but-low-real-risk case, though it is not a top-tier remote threat. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: it requires local access and some existing (low) privilege, has low attack complexity, needs no user interaction, and yields full confidentiality/integrity/availability impact - the classic profile of a weak-permissions service directory that lets an unprivileged local user escalate to SYSTEM. No EPSS score was supplied, so exploitation probability cannot be quantified. The vulnerability is NOT on the CISA KEV list and there is no evidence of active exploitation. The sole reference is a third-party researcher advisory (JNDataRT/Vulns on GitHub); whether it contains working exploit code versus a technical writeup is not confirmed from the metadata, so POC availability is treated as unconfirmed. Signals are consistent (local-only vector matches a CWE-276 permissions flaw), with no contradiction between the vector and the description. The practical priority is moderate-to-high for environments that run Hyland Desktop Host on shared/multi-user Windows hosts, and lower where only trusted single administrators have local access.

A local user with limited privileges who already has a foothold on a Windows machine running a vulnerable Hyland Desktop Host (before 25.1.1) notices that the privileged service's executable directory under %PROGRAMDATA%\Hyland\DesktopHost\bin is writable by non-administrators. They replace or plant a binary/DLL in that folder, and when the privileged service starts or restarts, the attacker's code runs with the service's elevated (typically SYSTEM) privileges. No user interaction or remote access is required, but the attacker must first have local code execution as an unprivileged user.