A local privilege escalation flaw exists in MyReport Updater 2.1.1. The vulnerability lets a low‑privileged user instruct the SYSTEM‑privileged updater service to install attacker‑supplied archives into any directory. By using UpdaterManager.exe over gRPC to specify a malicious reference server and install location, an attacker can plant a DLL (e.g., HID.dll) that is loaded by osk.exe, thereby gaining SYSTEM privileges. The weakness is a classic example of improper authorization and is identified as CWE‑269.

The affected product is Report One MyReport Updater, with versions up to and including 2.1.1 susceptible. Users of any earlier or later versions that have not been updated are not impacted.

The CVSS rating of 8.5 indicates high severity, while the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: a user who can execute UpdaterManager.exe must already possess low‑privilege rights. After exploitation, the attacker achieves SYSTEM privileges and can modify the system arbitrarily. The exploit requires no special network access but depends on the presence of the vulnerable service and the ability to run the updater client. Given the high severity and potential for complete system compromise, the risk level is high.