Threat database

System Informer versions before 4.0.26241.138 contain an incorrect authorization vulnerability in the phsvc helper. This flaw allows local attackers to access privileged APIs by connecting from any Authenticode-signed process. Exploitation involves loading code into a Microsoft-signed host process such as rundll32.exe and invoking PhSvcApiCreateService to execute code with SYSTEM privileges. The vulnerability has a high severity with a CVSS 4.0 score of 8.5.