System Informer Incorrect Authorization in phsvc ALPC Port
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
System Informer before 4.0.26241.138 has an incorrect authorization flaw in the phsvc helper, which lets local attackers reach privileged APIs by connecting from any Authenticode-signed process. An attacker with low privileges can load code into a Microsoft-signed host such as rundll32.exe, connect to the SiSvcApiPort ALPC port, and call PhSvcApiCreateService to run code as SYSTEM.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| winsiderss | System Informer | before 4.0.26241.138 | 4.0.26241.138 | Patch available | CNA |
- System Informer Vendorwinsiderss Affected before 4.0.26241.138 Fixed in 4.0.26241.138 Patch available CNA
Remediation
Update System Informer to version 4.0.26241.138 or later, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA System Informer (winsiderss) Fixed in 4.0.26241.138
Timeline
- 2026-10-09 Threatist record created from CVE-2026-107782
- 2026-10-10 Priority changed: MEDIUM → LOW
- 2026-10-14 CISA SSVC decision points changed
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences