Executive brief
Remote Utilities Host, a system administration and remote access tool, stores dynamic libraries (DLLs) in its installation directory with overly permissive access controls that allow any local user on the system to modify them. Since the Remote Utilities service runs with full system privileges (NT AUTHORITY\SYSTEM), a local attacker can replace these libraries during a service restart window and achieve complete system compromise with no authentication required. This creates a direct pathway for privilege escalation and persistent system control.
Technical details
This is a classic insecure file permissions vulnerability (CWE-276). The Remote Utilities Host service sets DLL files in C:\Program Files (x86)\Remote Utilities - Host\ with FULL CONTROL (ACE flag F) for the built-in Everyone group (BUILTIN\Everyone, S-1-1-0), allowing any local user to modify them. The service runs as NT AUTHORITY\SYSTEM and loads DLLs from this directory at startup, including libasset32.dll and seven others (eventmsg.dll, libcodec32.dll, vp8encoder.dll, vp8decoder.dll, webmvorbisdecoder.dll, webmvorbisencoder.dll, webmmux.dll). While DLLs are file-locked during runtime, a race condition window exists when the service stops (during updates or crashes), allowing a local attacker to write a malicious DLL. Upon service restart, the attacker's code executes with SYSTEM privileges. No network access or authentication is required; the attacker only needs local file system access.
Affected products
- Remote Utilities Host <=7.7.3.0
Timeline
- 2026-08-21: disclosed