# CVE-2026-110359: Hyland Desktop Host for Windows local privilege escalation

Source: https://junglewise.ai/threats/cve-2026-110359-hyland-desktop-host-for-windows-before-25-1-1-is-vulnerable-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110359 · Severity: high · CVSS 7.8 · Published 2026-10-14

Hyland Desktop Host is a Windows application that manages document handling and integration. A local user can exploit weak folder permissions and DLL loading behavior to execute malicious code with elevated LOCAL SERVICE privileges, leading to privilege escalation.

Vendors: [Hyland](https://junglewise.ai/threats/vendors/hyland).

## Quick answers

**Is CVE-2026-110359 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110359 being exploited in the wild.

**How severe is CVE-2026-110359?** High severity, with a CVSS score of 7.8, published 14 October 2026.

**Which products and versions are affected?** Hyland Desktop Host for Windows before 25.1.1.

**Is there a fix for CVE-2026-110359?** Yes: fixed in 25.1.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110359 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-110359?** Check whether you run Hyland Desktop Host for Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 25.1.1

## Technical details

The vulnerability is a DLL hijacking attack in Hyland.DesktopHost.Gateway.exe, a privileged service running as LOCAL SERVICE. The service installs to C:\ProgramData\Hyland\DesktopHost\bin with weak NTFS permissions that allow local authenticated users to write files. The service attempts to load cryptbase.dll from this world-writable directory, allowing an attacker to place a malicious DLL that will be executed on the next system boot.

## Affected products

- Hyland Desktop Host for Windows before 25.1.1

## Timeline

- 2026-10-14: disclosed

## References

- [https://github.com/JNDataRT/Vulns/blob/main/Advisories/2026/1.md](https://github.com/JNDataRT/Vulns/blob/main/Advisories/2026/1.md)