CVE-2026-82670 IObit Uninstaller IOCTL IUForceDelete.sys IRP_MJ_DEVICE_CONTROL privileges management
Local attackers can exploit an IOCTL handler flaw in IObit Uninstaller to escalate privileges due to improper management.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82670?
CVE-2026-82670 is a medium-severity vulnerability in IObit Uninstaller, published on 31 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUForceDelete.sys of the component IOCTL Handler. Executing a manipulation can lead to improper privilege management. The attack requires local access. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2026-82670?
How do I fix CVE-2026-82670?
No fix has been published for CVE-2026-82670 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82670 being exploited?
There is no known exploitation of CVE-2026-82670 in the wild and no public exploit code.
Sources
Also known as GHSA-9g52-22pq-r5cg.