Advisory · CVE-2026-107782
System Informer helper service lets signed processes escalate to SYSTEM
System Informer's privileged helper accepts connections from any Authenticode-signed process, letting local attackers reach SYSTEM-level APIs.
- Vendor
- System Informer
- Product
- System Informer
- Identifier / CWE
- CVE-2026-107782
CWE-863 - Action timing
- Immediate
Explain it like I’m five
The VIP elevator checks whether you are wearing any official-looking badge, not whether you are on the guest list. Borrow a badge, ride to the top floor.
- 01Code in signed host
A local attacker loads code into a Microsoft-signed process such as rundll32.exe.
- 02Connect to helper
The signed process connects to the System Informer helper port, passing the weak check.
- 03Privileged call
The attacker calls the helper's service API to execute code as SYSTEM.
What happened
System Informer versions before 4.0.26241.138 contain an incorrect authorization vulnerability in the phsvc helper, according to the disclosure. Local attackers can reach privileged APIs by connecting from any Authenticode-signed process: loading code into a Microsoft-signed host like rundll32.exe passes the check, and the helper’s service API can then be used to execute code as SYSTEM. The CVSS 4.0 score is 8.5.
System Informer is the open-source successor to Process Hacker, widely used by administrators and incident responders, which makes its privileged helper an attractive target.
What to do
- Check the installed System Informer version; anything before 4.0.26241.138 is affected.
- Upgrade to 4.0.26241.138 or later.
- On shared or sensitive hosts, review for unexpected SYSTEM-level processes that may predate the upgrade.
Management note
Local privilege escalation in a tool your own responders run is a quiet risk. It is a short patch, so take it.