Desktop Host
Monthly
Local privilege escalation in Hyland Desktop Host for Windows (all versions before 25.1.1) lets a low-privileged local user gain full administrative control of the host by abusing weak filesystem permissions on the directory from which a privileged service runs. The affected service executes out of %PROGRAMDATA%\Hyland\DesktopHost\bin, a location writable by non-administrative users; an attacker who can drop or replace a binary or library there and trigger a service (re)start causes that code to execute with the service's elevated (typically SYSTEM) context, yielding confidentiality, integrity, and availability impact across the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), although the attack is technically straightforward to reproduce on a shared or multi-user machine where an unprivileged account already exists.
Local privilege escalation in Hyland Desktop Host for Windows (all versions before 25.1.1) lets a low-privileged local user gain full administrative control of the host by abusing weak filesystem permissions on the directory from which a privileged service runs. The affected service executes out of %PROGRAMDATA%\Hyland\DesktopHost\bin, a location writable by non-administrative users; an attacker who can drop or replace a binary or library there and trigger a service (re)start causes that code to execute with the service's elevated (typically SYSTEM) context, yielding confidentiality, integrity, and availability impact across the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), although the attack is technically straightforward to reproduce on a shared or multi-user machine where an unprivileged account already exists.