CVE-2026-107782
System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port
winsiderss System Informer
CVSS
8.5HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.11%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.0.26241.138System InformerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.
Text from CVE List
Affected versions 2
- System Informeraffected: all versions before 4.0.26241.138CVE List
- System Informerunaffected: 4.0.26241.138CVE List
References 5
- github.com/winsiderss/systeminformer/commit/ce451a264a424f6f386b1615df651f8364aaeb9fFixvia CVE List
- github.com/winsiderss/systeminformer/releases/tag/v4.0.26241.138Fixvia CVE List
- vulncheck.com/advisories/system-informer-before-4.0.26241.138-incorrect-authorization-in-phsvc-alpc-portAdvisoryvia CVE List
- github.com/winsiderss/systeminformer/blob/v3.2.25011.2103/SystemInformer/phsvc/svcapiport.c#L196-L230Referencevia CVE List
- github.com/winsiderss/systeminformerReferencevia CVE List