CVE-2026-14208: Remote Utilities Host Privilege Escalation

CVE-2026-14208 Overview

CVE-2026-14208 is a local privilege escalation vulnerability in Remote Utilities Host versions <=7.7.3.0. The installer applies insecure Access Control Lists (ACLs) to all DLL files in C:\Program Files (x86)\Remote Utilities - Host\, granting FULL CONTROL to the built-in Everyone group (BUILTIN\Everyone, SID S-1-1-0). A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this directory. A local unprivileged attacker can replace a DLL during a service stop window and gain SYSTEM-level code execution on service restart. The issue is tracked under [CWE-732: Incorrect Permission Assignment for Critical Resource].

Critical Impact
A local unprivileged user can escalate to NT AUTHORITY\SYSTEM by replacing a Remote Utilities Host DLL during a service restart window.

Affected Products

Remote Utilities Host <=7.7.3.0 on Windows
Confirmed loaded DLL: libasset32.dll
Additional DLLs with identical insecure permissions: eventmsg.dll, libcodec32.dll, vp8encoder.dll, vp8decoder.dll, webmvorbisdecoder.dll, webmvorbisencoder.dll, webmmux.dll

Discovery Timeline

2026-08-21 - CVE-2026-14208 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-14208

Vulnerability Analysis

The Remote Utilities Host installer configures the installation directory with permissive ACLs that grant the Everyone group FULL CONTROL over every DLL used by the product. The Remote Utilities Host Windows service loads these DLLs into a process running as NT AUTHORITY\SYSTEM. While the service is running, the operating system holds file locks on loaded modules, which prevents in-place replacement of DLLs on disk.

A race window opens whenever the service is stopped. This occurs during software updates, after a service crash, or when an administrator manually restarts the service. During this window, no file lock exists on the DLLs, and any local user can overwrite them because of the Everyone:F ACL. On the next service start, the SYSTEM-level process loads the attacker-supplied DLL and executes its code with the highest local privileges.

Root Cause

The root cause is an insecure permission assignment ([CWE-732]) applied to files that are loaded by a privileged service. The BUILTIN\Everyone principal should not receive write access to binaries executed by NT AUTHORITY\SYSTEM. Standard Windows conventions restrict Program Files (x86) subdirectory writes to administrators and TrustedInstaller.

Attack Vector

Exploitation requires local access with any authenticated user context. The attacker stages a malicious DLL that exports the symbols expected by the Remote Utilities Host service. The attacker then waits for or induces a service stop, for example by triggering a product update or waiting for a crash. During the unlock window, the attacker overwrites libasset32.dll or another loaded DLL in the installation directory. When the service restarts, the payload runs as NT AUTHORITY\SYSTEM.

No proof-of-concept code has been published for CVE-2026-14208. See the Remote Utilities Release Notes for vendor fix details.

Detection Methods for CVE-2026-14208

Indicators of Compromise

Modification timestamps on files in C:\Program Files (x86)\Remote Utilities - Host\ that do not correspond to a vendor installer or update event.
Unexpected child processes spawned by the Remote Utilities Host service running as NT AUTHORITY\SYSTEM.
DLL files in the Remote Utilities Host directory with digital signatures that fail validation or are missing entirely.
Recent writes to libasset32.dll, eventmsg.dll, libcodec32.dll, vp8encoder.dll, vp8decoder.dll, webmvorbisdecoder.dll, webmvorbisencoder.dll, or webmmux.dll by non-administrative principals.

Detection Strategies

Audit ACLs on the Remote Utilities Host installation directory using icacls and alert when Everyone or BUILTIN\Users holds write or full control on any DLL.
Enable Windows file system auditing (Event ID 4663) on the installation directory to record write operations to DLLs by unprivileged users.
Monitor Service Control Manager events (Event IDs 7034, 7036) for unexpected stops and restarts of the Remote Utilities Host service.
Correlate DLL modification events with subsequent service start events to identify the exploitation pattern.

Monitoring Recommendations

Baseline the file hashes of vendor-shipped DLLs and alert on drift outside approved update windows.
Track process creation events where the parent is the Remote Utilities Host service and the child is cmd.exe, powershell.exe, or another interpreter.
Route these signals into a centralized data lake such as Singularity Data Lake for retention and correlation across endpoints.

How to Mitigate CVE-2026-14208

Immediate Actions Required

Restrict ACLs on C:\Program Files (x86)\Remote Utilities - Host\ and all contained DLLs to Administrators, SYSTEM, and TrustedInstaller, removing any grant to Everyone or Users.
Inventory endpoints running Remote Utilities Host at version 7.7.3.0 or earlier and prioritize them for remediation.
Verify the integrity and digital signatures of DLLs in the installation directory before allowing the service to restart.
Limit interactive logon on servers that host the Remote Utilities service to trusted administrative accounts.

Patch Information

Consult the Remote Utilities Release Notes for the fixed version and upgrade guidance. Apply the vendor update on all affected hosts and confirm that the installer resets directory permissions to a secure default.

Workarounds

Manually reset directory ACLs using icacls to remove the Everyone grant until the patched installer is deployed.
Configure application allowlisting (for example, Windows Defender Application Control or AppLocker) to block execution of unsigned DLLs from the installation directory.
Disable and stop the Remote Utilities Host service on systems where the product is not actively required.

bash

# Remove insecure ACL entries and restore administrative ownership
icacls "C:\Program Files (x86)\Remote Utilities - Host" /remove:g "Everyone"
icacls "C:\Program Files (x86)\Remote Utilities - Host" /inheritance:r
icacls "C:\Program Files (x86)\Remote Utilities - Host" /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F" "NT SERVICE\TrustedInstaller:(OI)(CI)F"