Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-107782System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port

High 7.8

In plain English

A high-severity incorrect authorization in System Informer from winsiderss. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.1%top 98.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.

Affected products (as reported)

Vendor	Product	Versions
winsiderss	System Informer	0 – before 4.0.26241.138

Weakness: CWE-863 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Patch Commit patch
https://github.com/winsiderss/systeminformer/blob/v3.2.25011.2103/SystemInformer/phsvc/svcapiport.c#L196-L230 technical-description
System Informer v4.0.26241.138 Release Notes release-notes
https://github.com/winsiderss/systeminformer product
VulnCheck Advisory: System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port third-party-advisory