EUVD-2026-36676
GHSA-j9g6-3rjm-j8f4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low-privilege requirement confirmed by description and CVSS 4.0; all impact axes low with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in IObit Malware Fighter up to 13.2.0. Affected by this vulnerability is an unknown functionality of the component DLL Handler. This manipulation causes permission issues. The attack requires local access. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Permission misconfiguration in IObit Malware Fighter's DLL Handler component (versions up to 13.2.0) allows a local low-privileged attacker to exploit insecure resource permissions, resulting in low-severity confidentiality, integrity, and availability impacts. The vulnerability stems from CWE-275 (Improper Permission Assignment for a Resource), and a public proof-of-concept exploit is available via GitHub and a researcher blog post. The vendor was notified prior to disclosure but did not respond, meaning no official patch or mitigation guidance has been issued.
Technical ContextAI
The affected product is IObit Malware Fighter, a Windows-based antimalware application identified by CPE cpe:2.3:a:iobit:malware_fighter:*:*:*:*:*:*:*:*. The vulnerable component is the DLL Handler, which manages dynamic-link library loading and associated file-system interactions. CWE-275 (Improper Permission Assignment for a Resource) indicates that the DLL files or directories associated with the handler are configured with overly permissive ACLs, enabling low-privileged local users to read, modify, or potentially replace DLL files. This class of flaw is commonly associated with DLL hijacking or DLL planting attack patterns in security software, where improperly secured directories allow an attacker to stage a malicious DLL that the privileged service subsequently loads. The CVSS 4.0 vector confirms local access (AV:L), low attack complexity (AC:L), no special attack requirements (AT:N), and low-privileged user access (PR:L), with uniform low impact across confidentiality, integrity, and availability for the vulnerable system and no downstream system impact.
RemediationAI
No vendor-released patch has been identified at time of analysis - IObit did not respond to the researcher's coordinated disclosure, and no patched version is confirmed. Organizations running IObit Malware Fighter 13.2.0 or earlier should take the following specific compensating controls: restrict write access to IObit Malware Fighter's installation directory and DLL subdirectories using Windows ACL hardening (icacls), ensuring only SYSTEM and Administrators have modify/write permissions on the DLL Handler paths - this directly removes the insecure permission condition identified by CWE-275. Additionally, enable Windows Defender Credential Guard or application whitelisting (e.g., AppLocker, WDAC) to prevent unsigned or unexpected DLLs from loading in privileged process contexts. Security teams should monitor the IObit vendor advisory channel and the VulDB entry at https://vuldb.com/vuln/370844 for patch availability. The researcher PoC is documented at https://github.com/nasawyer7/IObitDriverav and https://nathan2.com/posts/iobit/ and should be reviewed to understand the precise DLL paths affected when applying ACL fixes.
More in Malware Fighter
View allA vulnerability was found in IObit Malware Fighter 9.4.0.776. Rated high severity (CVSS 7.8), this vulnerability is low
An issue exits in IOBit Malware Fighter version 8.0.2.547. Rated high severity (CVSS 7.8), this vulnerability is no auth
RegFilter.sys in IOBit Malware Fighter 6.2 is susceptible to a stack-based buffer overflow when an attacker uses IOCTL 0
RegFilter.sys in IOBit Malware Fighter 6.2 is susceptible to a stack-based buffer overflow when an attacker uses IOCTL 0
RegFilter.sys in IOBit Malware Fighter 6.2 is susceptible to a stack-based buffer overflow when an attacker uses IOCTL 0
RegFilter.sys in IOBit Malware Fighter 6.2 is susceptible to a stack-based buffer overflow when an attacker uses IOCTL 0
RegFilter.sys in IOBit Malware Fighter 6.2 and earlier is susceptible to a stack-based buffer overflow when an attacker
IMFCameraProtect.sys in IObit Malware Fighter 6.2 (and possibly lower versions) is vulnerable to a stack-based buffer ov
IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administ
IMFForceDelete.sys in IObit Malware Fighter 6.2 allows a low privileged user to send IOCTL 0x8016E000 along with a user
IObit Malware Fighter v11.0.0.1274 is vulnerable to a Denial of Service vulnerability by triggering the 0x8001E00C IOCTL
A vulnerability was found in IObit Malware Fighter 9.4.0.776. Rated medium severity (CVSS 5.5), this vulnerability is lo
Same weakness CWE-275 – Permission Issues
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today