CVE-2026-110633

CVSS 8.5 (high) · published 2026-10-14

MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.

Weakness: CWE-269

Source: NVD CVE-2026-110633

References

• https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html
• https://www.myreport.fr/myreport/
• https://www.vulncheck.com/advisories/myreport-updater-through-2.1.1-local-privilege-escalation-via-updater-service

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.