{"id":"CVE-2026-107782","published":"2026-10-08T21:17:53.227","lastModified":"2026-10-14T02:16:58.353","description":"System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/winsiderss/systeminformer","tags":[]},{"url":"https://github.com/winsiderss/systeminformer/blob/v3.2.25011.2103/SystemInformer/phsvc/svcapiport.c#L196-L230","tags":[]},{"url":"https://github.com/winsiderss/systeminformer/commit/ce451a264a424f6f386b1615df651f8364aaeb9f","tags":[]},{"url":"https://github.com/winsiderss/systeminformer/releases/tag/v4.0.26241.138","tags":[]},{"url":"https://www.vulncheck.com/advisories/system-informer-before-4.0.26241.138-incorrect-authorization-in-phsvc-alpc-port","tags":[]}],"exploitRefs":[{"url":"https://github.com/winsiderss/systeminformer","tags":[]},{"url":"https://github.com/winsiderss/systeminformer/blob/v3.2.25011.2103/SystemInformer/phsvc/svcapiport.c#L196-L230","tags":[]},{"url":"https://github.com/winsiderss/systeminformer/commit/ce451a264a424f6f386b1615df651f8364aaeb9f","tags":[]},{"url":"https://github.com/winsiderss/systeminformer/releases/tag/v4.0.26241.138","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows local attackers to bypass authorization checks in System Informer's helper service, enabling them to execute arbitrary code with SYSTEM privileges by connecting from any Authenticode-signed process. This creates a privilege escalation vector where attackers can load malicious code into Microsoft-signed processes like rundll32.exe and call privileged APIs.","exploitability":"Exploitation is moderately easy requiring only a local attacker with access to an Authenticode-signed process, as the vulnerability allows direct API calls to the privileged service without proper authentication checks.","blast_radius":"The impact could be significant as local attackers can escalate privileges to SYSTEM level, potentially allowing full system compromise through code execution in high-privilege processes.","remediation":"Upgrade to System Informer version 4.0.26241.138 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","auth-bypass","windows"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:21:30.069Z"}}