Security update for Lime CRM Desktop Client update service

Bulletin ID

LCSEC26-10

Date published

2026-10-20

Priority

2

Severity

Critical

Priority and severity ratings are determined as described here.

This security update resolves vulnerabilities in the Lime Maintenance Service, which the Lime CRM Desktop Client installs to install updates. The vulnerabilities allow local privilege escalation on Windows.

Lime CRM Server and Lime Data Components (LDC) are not affected.

All earlier builds of Lime CRM Desktop Client are withdrawn from download.

Upgrade to the newest version of Lime CRM Desktop Client. The upgrade also replaces the Lime Maintenance Service.

Where the client cannot be upgraded at once, install the Lime Maintenance Service update instead. It updates only the service and does not change the client. A user without administrator rights can start it: it asks the installed service to install it, and asks for administrator credentials only when the installed service cannot do so. It only upgrades an installed service. It never installs, uninstalls or downgrades the service. When it cannot upgrade a vulnerable service, it disables that service.

A Lime Maintenance Service of version 12.0.4747 or later contains this update. A computer updated with the Lime Maintenance Service update also has the registry value PatchedVersion under HKLM\SOFTWARE\WOW6432Node\Lime\MaintenanceServiceUpdate.

With the Lime Maintenance Service update, the client stays on its earlier version. The updated service does not accept older client installers, so automatic updates of such a client to another earlier version do not work. Plan the upgrade of the client.

To avoid installing an earlier version that still contains the vulnerabilities by mistake, remove older Lime CRM Desktop Client installers from shared folders, download folders and software deployment systems, and use only 11.3.4747 or later. This also applies when the client is deployed with a software deployment tool.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in this situation:

• The attacker must be able to log on to the computer, or already run code as a user on it. The vulnerabilities cannot be exploited over the network alone.
• Lime knows of no exploitation of these vulnerabilities.

Workaround refers to a setting or configuration change that would help block known attack vectors before you apply the update.

• Disable the Lime Maintenance Service until the update is installed. Stopping the service is not enough; it must be disabled.
  • On one computer, run these commands in a Command Prompt started as administrator:

    sc.exe stop LimeMaintenanceService
    sc.exe config LimeMaintenanceService start= disabled

  • On many computers, use Group Policy: Computer Configuration > Policies > Windows Settings > Security Settings > System Services > Lime Maintenance Service, startup mode Disabled. The policy only lists the service when the computer that edits the policy has it installed.
  • Impact: automatic updates of Lime CRM Desktop Client do not work while the service is disabled. An administrator can still install the update manually.
  • After the update, remove the Group Policy setting if you used one, and enable the service again on each computer. The startup mode a policy has set stays on the computer after the setting is removed.

    sc.exe config LimeMaintenanceService start= demand