MyReport Updater EUVD-2026-101261

Exploitation requires that MyReport Updater (through 2.1.1) is installed and its updater component runs as a SYSTEM service exposing a gRPC control interface via UpdaterManager.exe reachable by non-privileged local users. The attacker must already possess low-privileged authenticated access to the host (PR:L) and be able to reach the local gRPC endpoint, set a malicious reference server and an arbitrary installLocation, and write/stage an archive containing a DLL (e.g., HID.dll) into a path auto-loaded by osk.exe. Limiting factors: the vector is local only (AV:L) - no remote or network exploitation path - so the attacker needs a prior foothold; exploitation is Windows-specific and depends on the vulnerable updater service being present and running with SYSTEM rights. No user interaction is required (UI:N).

This is a genuine, actionable local privilege escalation rather than an inflated high-CVSS score, though it is not a mass-exploitation emergency. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, 8.5) is internally consistent with the description: a local, low-privileged user leverages a SYSTEM-level updater service to gain full SYSTEM control, yielding high confidentiality, integrity, and availability impact with low attack complexity and no user interaction. The AV:L (local) attack vector is the single biggest risk-limiting factor - an attacker must already have authenticated code-execution or interactive access on the host, so this is a post-compromise escalation primitive, not an internet-facing entry point. A working exploit is publicly available (Quarkslab technical write-up), which materially raises practical risk and lowers the skill barrier. No CISA KEV listing and no EPSS score were provided; EPSS for local-only privilege escalation flaws is typically low and should not be read as low danger - EPSS models remote mass-exploitation probability, which does not apply to a local vector. Reporting by VulnCheck plus a detailed public blog increases the credibility and reproducibility of the technique. Bottom line: prioritize for patching on any multi-user or shared Windows host running MyReport Updater, but it ranks below unauthenticated remote flaws for triage because it presupposes an existing foothold.

A low-privileged user (or malware running in a standard user context) on a Windows machine with MyReport Updater installed invokes UpdaterManager.exe to talk to the updater service over gRPC, pointing it at an attacker-controlled reference server and a chosen installLocation. The SYSTEM-privileged service then installs an attacker-supplied archive that plants a malicious HID.dll into a directory where it is auto-loaded by osk.exe (the on-screen keyboard), executing attacker code as SYSTEM. A public proof-of-concept and detailed methodology are available via Quarkslab, so exploitation is low-complexity and reproducible.