This vulnerability arises from a privileged background service that runs from the %PROGRAMDATA%\\Hyland\\DesktopHost\\bin directory, which is accessed through a Windows service with insufficient file permissions. The flaw is a CWE‑276 weakness that permits a local user to manipulate the service’s execution context and elevate privileges. Once exploited, the attacker can run code with administrative rights, compromising both the confidentiality and integrity of the host system. The impact is confined to the machine where the service operates and requires the attacker to be able to execute code locally.

Hyland Desktop Host for Windows, versions prior to 25.1.1. The affected component is the Desktop Host service that runs with elevated permissions on Windows machines.

The CVSS score of 7.8 signals a high severity for this local privilege escalation. The EPSS of <1% suggests that the vulnerability is currently not widely exploited, and it is not listed in the CISA KEV catalog, indicating no known active exploitation campaigns. The attack vector is local, demanding that the attacker already has a user account on the target system capable of running applications. Because the vulnerability hinges on weak file system permissions, any system with a user that can write to the bin directory faces a moderate to high risk if privileged operations are at stake.