Vulnerability DatabaseCVE-2026-107782
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-107782
Published:October 08, 2026
Updated:October 13, 2026
System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.
Affected Packages
https://github.com/winsiderss/systeminformer.git (GITHUB):
Affected version(s) >=v2.36 <v4.0.26241.138
Fix Suggestion:
Update to version v4.0.26241.138
Related Resources (7)
https://github.com/winsiderss/systeminformer
https://www.vulncheck.com/advisories/system-informer-before-4.0.26241.138-incorrect-authorization-in-phsvc-alpc-port
https://github.com/winsiderss/systeminformer/blob/v3.2.25011.2103/SystemInformer/phsvc/svcapiport.c#L196-L230
https://nvd.nist.gov/vuln/detail/CVE-2026-107782
https://github.com/winsiderss/systeminformer/commit/ce451a264a424f6f386b1615df651f8364aaeb9f
https://github.com/winsiderss/systeminformer/releases/tag/v4.0.26241.138
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107782.json
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.5
Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Incorrect Authorization
CWE-863
EPSS
Base Score:
0.11