Local privilege escalation in Honeywell IQ MultiAccess update service

Honeywell IQ MultiAccess Update Service was affected by a local privilege escalation vulnerability. Due to a named pipe configured with a NULL DACL, a low-privileged user was able to communicate with the IQUpdSrv service running as SYSTEM. An attacker was able to execute arbitrary code with SYSTEM privileges by supplying specially crafted data. The vendor provides patched versions which mitigate the issue.
CVE-2026-13742

Read the full post here