System Informer
Monthly
Local privilege escalation in System Informer before 4.0.26241.138 allows an attacker who already holds a low-privilege foothold on a machine where the phsvc helper is running to reach privileged APIs over the SiSvcApiPort ALPC endpoint and execute code as SYSTEM. The pre-patch authorization check accepted any Authenticode-signed caller, so an attacker can load or inject code into a Microsoft-signed host such as rundll32.exe and invoke PhSvcApiCreateService without forging a signature; the attack is strictly local (AV:L) and requires System Informer to be installed and its helper service active, meaning this is a post-compromise escalation rather than an internet-facing emergency. The vendor has released a fix in 4.0.26241.138, and no public exploit identified at time of analysis.
Local privilege escalation in System Informer before 4.0.26241.138 allows an attacker who already holds a low-privilege foothold on a machine where the phsvc helper is running to reach privileged APIs over the SiSvcApiPort ALPC endpoint and execute code as SYSTEM. The pre-patch authorization check accepted any Authenticode-signed caller, so an attacker can load or inject code into a Microsoft-signed host such as rundll32.exe and invoke PhSvcApiCreateService without forging a signature; the attack is strictly local (AV:L) and requires System Informer to be installed and its helper service active, meaning this is a post-compromise escalation rather than an internet-facing emergency. The vendor has released a fix in 4.0.26241.138, and no public exploit identified at time of analysis.