Remote Utilities Host versions up to 7.7.3.0 insecurely grant write access to the built‑in Everyone group on all DLL files in the installation directory. The Windows service, running as NT AUTHORITY\SYSTEM, loads these DLLs from this directory. A race window occurs when the service stops, such as during a crash or update, allowing a local user with write permission to replace a DLL with a malicious payload. When the service restarts, the payload executes with SYSTEM privileges, providing full system control. This flaw is a classic insecure permissions weakness (CWE‑732).

The affected product is Remote Utilities Host from Remote Utilities Pte. Ltd., any installation of the software running version 7.7.3.0 or earlier. DLL files located in C:\Program Files (x86)\Remote Utilities - Host\ (e.g., libasset32.dll, eventmsg.dll, libcodec32.dll, vp8encoder.dll, webmvorbisdecoder.dll, webmmux.dll, among others) share the insecure ACL configuration. No additional version granularity is provided beyond the maximum affected build.

The CVSS score of 7.3 indicates moderate to high severity. The EPSS score is not available, so the quantifiable probability of exploitation is unknown, but the flaw is practical for local users with access to the machine. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no publicly documented exploitation at this time. The attack vector is local, requiring an attacker to stop the service and write to the protected DLL directory, a scenario that can be achieved with standard administrative tools or during normal update procedures.