Insecure ACLs in Remote Utilities Host Allow DLL Hijacking by Local Attackers

CVE-2026-14208

What is CVE-2026-14208?

Remote Utilities Host prior to version 7.7.3.0 contains a vulnerability due to improper Access Control Lists (ACLs) set on DLL files in the installation directory. These permissions grant FULL CONTROL to the Everyone group, allowing local unprivileged attackers to replace legitimate DLL files with malicious payloads during a race condition when the Windows service is stopped. Upon restarting the service, the malicious payload, running with SYSTEM privileges, can execute, leading to potential system compromise. This highlights the critical importance of securing directory permissions to prevent unauthorized access and execution of harmful code.

References