CVE-2026-50610: Elevation of Privileges to SYSTEM via Acer NitroSense

CVE-2026-50610: Elevation of Privileges to SYSTEM via Acer NitroSense

Cassius Garat, a researcher at Intrinsec, discovered a vulnerability in Acer System Monitor, the shared engine used by the NitroSense and PredatorSense utilities for managing hardware performance and cooling on Acer laptops. The vulnerability, CVE-2026-50610, allows a standard Windows user to obtain NT AUTHORITY\SYSTEM privileges.

The background service AcerSysHardwareService.exe runs as SYSTEM and accepts commands through the named pipe systemmonitoring_hardware_service_. The pipe is accessible to all authenticated users, but the service neither checks the client's privileges nor impersonates the client when processing requests.

The researcher reverse-engineered the communication protocol and identified commands for creating and deleting Windows Registry keys, as well as reading, writing, and deleting registry values. In particular, cmd=3 allows an attacker to create registry keys and write values with SYSTEM privileges, including in protected areas of HKLM.

How Does This Lead to Privilege Escalation? A standard user sends a registry modification command to the vulnerable service. Using the Image File Execution Options (IFEO) mechanism, the attacker sets cmd.exe as the debugger for utilman.exe. When the accessibility feature is launched from the Windows login screen, cmd.exe starts with SYSTEM privileges instead of utilman.exe. The researcher confirmed the exploit: a direct attempt to modify the protected registry key was denied by Windows, but the same operation succeeded through the Acer service.

The affected versions are AcerSysHardwareService.exe 1.0.1018.13 and 1.0.1019.0 (NitroSense 5.1.361 engine). The vulnerability was reported to Acer in May 2026. The research does not specify the exact fixed version.

Article: https://www.intrinsec.com/cve-2026-50610-elevation-privileges-acer-nitrosense/