Acer System Monitor: from standard user to SYSTEM with CVE-2026-50610

A detailed write-up of CVE-2026-50610 describing an improper access-control vulnerability in Acer System Monitor (NitroSense/PredatorSense) where a SYSTEM service exposes a named pipe that authenticated users can write to and the service does not impersonate callers. Attackers can send crafted pipe messages to perform arbitrary HKLM registry writes as SYSTEM, which the author demonstrates converting to full SYSTEM code execution via Image File Execution Options, affecting specific AcerSysHardwareService.exe versions and accompanied by vendor mitigation guidance.