CVE-2026-107782: System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port
System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.
Affected Software
Event History
Frequently Asked Questions
Which release includes the fix?
The issue is fixed in System Informer 4.0.26241.138. Versions before that release are affected.
What level of access does an attacker need?
The attacker needs local access and the ability to execute code. Exploitation can involve loading code into an Authenticode-signed process, such as Microsoft-signed rundll32.exe; no user interaction is required.
What activity can help identify possible exploitation?
Investigate Microsoft-signed processes, including rundll32.exe, connecting to SiSvcApiPort and invoking the PhSvcApiCreateService API. This activity may indicate an attempt to create a service and execute code as SYSTEM.