CVE-2026-14208: CWE-732: Incorrect Permission Assignment for Critical Resource in Remote Utilities Pte. Ltd. Remote Utilities Host

Remote Utilities Host versions <=7.7.3.0 set insecure Access Control Lists (ACLs) on all DLL files in the installation directory, granting full control to the built-in Everyone group. A Windows service running as NT AUTHORITY\SYSTEM loads these DLLs. Although DLLs are locked at runtime, a race condition exists when the service is stopped, allowing a local unprivileged attacker to replace DLLs with malicious payloads. Upon service restart, the malicious DLL executes with SYSTEM privileges. DLLs affected include libasset32.dll, eventmsg.dll, libcodec32.dll, vp8encoder.dll, vp8decoder.dll, webmvorbisdecoder.dll, webmvorbisencoder.dll, and webmmux.dll.

An attacker with local unprivileged access can exploit the insecure permissions to replace critical DLL files during a service downtime window. This leads to arbitrary code execution with SYSTEM privileges when the service restarts, potentially compromising the entire system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to the affected system and monitor for suspicious activity during service restarts. Avoid stopping the Remote Utilities Host service unnecessarily to reduce the race window.