| Title | IObit IObit Uninstaller 15.5.0.11 Improper Privilege Management |
|---|
| Description | Vulnerability Timeline & Prior Proposal Notice:
- Baseline Telemetry Logged: July 9, 2026 (via Tracker ID CAN-2026-2033404)
The discoverers previously logged a preliminary tracker under ID CAN-2026-2033404 to establish baseline telemetry. This VulDB submission represents the formal technical escalation and active CVE assignment request by the original exclusive authors to ensure active tracking and coordination.
Summary:
An issue in IObit Uninstaller v15.5.0.11 allows local low-privileged users to achieve arbitrary file deletion and potential Denial of Service (DoS) via a crafted IOCTL request. The vulnerability exists within the kernel-mode driver IUForceDelete.sys (v1.0.5.18, SHA-256: bdc3bef457e5c94fa567159fa4b01c54496c5f093c92ce24b1c8c0d91f56a3fe).
Technical Analysis & Exploit Primitives:
The driver creates a named device object at "\\.\IUForceDelete123" via IoCreateDevice without restrictive Discretionary Access Control Lists (DACLs) or any proper privilege validation. Consequently, a local authenticated low-privileged user-mode process can successfully open a valid handle to this device.
By sending the specific IOCTL code 0x8016E000, the IRP_MJ_DEVICE_CONTROL dispatch routine executes file deletion primitives on user-controlled paths within the Ring 0 kernel context, completely bypassing user-mode file system security constraints. Attackers can leverage this mechanism to force-delete critical operating system files, manipulate configuration files, or cause a permanent Denial of Service (DoS).
Prior Art & Distinct Scope Justification:
While this vulnerability shares a similar IOCTL code and root cause primitive with CVE-2025-26125 (CWE-782), CVE-2025-26125 strictly belongs to a different product line (IObit Malware Fighter) and an entirely different driver component. Furthermore, the digital signature and compilation timestamp of IUForceDelete.sys in IObit Uninstaller are older than the driver in CVE-2025-26125. This proves that the vendor has reused this insecure, legacy codebase across completely different products, making this a separate, unpatched component that independently requires a unique CVE ID.
Credit:
This vulnerability was co-discovered and analyzed by ElementXu ([email protected]) and lzty ([email protected]). Please credit both names in the final CVE publication.
|
|---|
| User | Element2023H (UID 99757) |
|---|
| Submission | 07/17/2026 09:31 (1 month ago) |
|---|
| Moderation | 08/30/2026 17:18 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 397169 [IObit Uninstaller 15.5.0.11 IOCTL IUForceDelete.sys IRP_MJ_DEVICE_CONTROL privileges management] |
|---|
| Points | 17 |
|---|