Which versions of Revo Uninstaller are affected by CVE-2026-12193?

VS Revo RevoUninstaller versions 2.5.x and 2.6.x contain a high-severity local privilege escalation vulnerability affecting all organizations using this software.. A patch is available.

Is there a public PoC exploit available for CVE-2026-12193?

Yes, a public proof-of-concept exploit is available for CVE-2026-12193. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-12193?

Within 24 hours: Identify and inventory all systems running RevoUninstaller versions 2.5.x or 2.6.x; restrict local system access permissions where operationally feasible. Within 7 days: Apply vendor-released patch to upgrade all affected systems to versions beyond 2.6.x. Within 30 days: Verify 100% patch deployment across all affected systems and confirm no systems remain on versions 2.5.x or 2.6.x.

Revo Uninstaller CVE-2026-12193

Q: What is the CVSS score of CVE-2026-12193?

CVE-2026-12193 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-36672 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-14 VulDB

GHSA-7w6g-hc67-vvxm

Buffer Overflow Heap Overflow Revouninstaller

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local IOCTL call requires an authenticated low-privileged user (AV:L, PR:L); no user interaction; successful pool overflow yields kernel-mode code execution with full CIA impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 15, 2026 - 00:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 15, 2026 - 00:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 15, 2026 - 00:22 vuln.today

cvss_changed

CVSS changed

Jun 15, 2026 - 00:22 NVD

8.5 (HIGH) 7.1 (HIGH)

Analysis Generated

Jun 14, 2026 - 23:58 vuln.today

DescriptionCVE.org

A vulnerability was identified in VS Revo RevoUninstaller 2.5.x/2.6.x. The affected element is the function IOCtl_Handler in the library RevoDetector.sys of the component IOCTL Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version 2.7.0 is sufficient to fix this issue. It is recommended to upgrade the affected component.

AnalysisAI

Local privilege escalation in VS Revo RevoUninstaller versions 2.5.x and 2.6.x is possible through a heap-based buffer overflow in the IOCtl_Handler function within the RevoDetector.sys kernel driver. Authenticated local users sending crafted IOCTL requests can corrupt kernel pool memory, potentially achieving SYSTEM-level code execution. Publicly available exploit code exists, and a detailed write-up plus PoC repository have been published, raising the practical risk despite no active exploitation listing.

Technical ContextAI

RevoDetector.sys is a Windows kernel-mode driver shipped with Revo Uninstaller to detect installation activity. The vulnerability is a CWE-122 heap-based buffer overflow in its IOCTL handler, meaning user-mode code that opens a handle to the driver and issues a specially crafted DeviceIoControl call can write past the bounds of an allocation in the non-paged kernel pool. Pool overflows in signed third-party drivers are a common vector for local privilege escalation on Windows because they execute in ring 0 with full kernel privileges, and exploitation typically involves grooming the pool and overwriting adjacent objects to hijack control flow or token data.

RemediationAI

Vendor-released patch: version 2.7.0 - upgrade RevoUninstaller to 2.7.0 or later by downloading from https://www.revouninstaller.com/start-freeware-download/, which replaces the vulnerable RevoDetector.sys with a fixed build. If immediate upgrade is not possible, uninstall RevoUninstaller entirely to remove the vulnerable driver from the host (trade-off: loss of uninstall-tracking functionality), or as an interim measure disable/unload the RevoDetector service so the driver does not load at boot (trade-off: RevoUninstaller's installation-monitoring feature will not work until re-enabled). On managed fleets also add the vulnerable RevoDetector.sys hash to the Microsoft vulnerable driver blocklist / WDAC policy to prevent BYOVD reuse even after the application is removed.