CVE-2026-110359 in Desktop Host
Summary
by MITRE • 10/14/2026
Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Hyland Desktop Host for Windows prior to version 25.1.1 represents a critical security flaw rooted in improper access control configurations within the application's service architecture. Specifically, the issue arises from a privileged system service that is executed from the directory path %PROGRAMDATA%\Hyland\DesktopHost\bin. The core technical deficiency lies in the file and folder permissions assigned to this location, which are configured with weak or overly permissive settings. In Windows operating systems, the ProgramData folder is typically accessible by standard local users for writing specific application data, but it should not grant write access to system binaries or configuration files that are executed with elevated privileges. By allowing a non-privileged user to modify files within this directory, the vulnerability creates an avenue for attackers to manipulate the execution flow of the privileged service.
From a technical perspective, this flaw aligns directly with CWE-250, which describes Execution with Unnecessary Privileges, and more critically, CWE-732, which pertains to Incorrect Permission Assignment for Critical Resource. The attack vector involves a local user creating or modifying an executable file within the %PROGRAMDATA%\Hyland\DesktopHost\bin folder such that it matches the name of a legitimate binary expected by the service. When the privileged service starts and attempts to load this component from the unsecured directory, it inadvertently executes code authored by the attacker but runs with the high-level permissions assigned to the service account. This mechanism is a classic example of an insecure search path or DLL hijacking scenario, where the operating system resolves file paths in a manner that allows lower-privileged entities to inject malicious payloads into higher-privileged processes.
The operational impact of this vulnerability is severe, as it enables local privilege escalation from a standard user account to SYSTEM-level access on the affected Windows host. Once an attacker achieves SYSTEM privileges, they gain unrestricted control over the operating system. This level of access allows for the installation of rootkits, creation of new administrative accounts, exfiltration of sensitive data stored locally or accessible via network shares, and further lateral movement within the enterprise network. Since this is a local vulnerability, it requires physical or remote desktop access to an unpatched endpoint where Hyland Desktop Host is installed with default or misconfigured permissions, making it particularly dangerous in environments where users have significant autonomy over their workstations but are not expected to possess administrative rights.
To mitigate this risk, organizations must immediately apply the vendor-provided patch that updates Hyland Desktop Host to version 25.1.1 or later, which corrects the permission settings on the specified directory and binaries. In environments where immediate patching is not feasible due to operational constraints, a compensating control involves manually restricting access permissions for the %PROGRAMDATA%\Hyland\DesktopHost\bin folder. Administrators should ensure that only the SYSTEM account and potentially specific service accounts have write or modify rights to this directory, while standard users are granted read-only execute access at most. Additionally, implementing strict application whitelisting policies can prevent unauthorized executables from running in sensitive system directories, thereby reducing the attack surface even if permission errors persist temporarily.
This vulnerability is categorized under MITRE ATT&CK technique T1055, which covers Process Injection and Privilege Escalation via Binary Planting techniques such as DLL Search Order Hijacking or PATH environment variable manipulation. Security teams should monitor for unusual process creation events originating from the ProgramData directory by privileged accounts, as this may indicate an active exploitation attempt. Regular auditing of file system permissions on directories containing service binaries is essential to prevent similar misconfigurations in other enterprise applications. Ensuring that services run with least-privilege principles and verifying that their execution paths are not writable by non-administrative users remains a fundamental best practice for maintaining endpoint security integrity against local privilege escalation attacks.