IObit Malware Fighter CVE-2026-12201

Requires an attacker to have local interactive or remote shell access to the target Windows system with at minimum a low-privileged (standard user) account - confirmed by CVSS 4.0 AV:L/PR:L. The target system must have IObit Malware Fighter version 13.2.0 or earlier installed and running. No special non-default configuration is required beyond a standard software installation. Exploitation is limited by the requirement for pre-existing local access: an attacker without any foothold cannot exploit this remotely. No user interaction from a privileged user is needed (UI:N). No special attack prerequisites apply (AT:N). The low impact ratings (VC:L/VI:L/VA:L) indicate that exploitation does not yield full system compromise - the attacker gains only partial access to confidentiality, integrity, or availability of resources within the scope of the Malware Fighter application itself.

The overall real-world risk is moderate-to-low despite the presence of a public exploit. The CVSS 4.0 score of 4.8 reflects constrained impact: all three impact axes (VC:L/VI:L/VA:L) are rated low, and no subsequent-system impact is modeled. The attack vector is strictly local (AV:L with PR:L), meaning the attacker must already have an interactive or remote session on the target host with at least a standard user account, which substantially limits the exposed population. EPSS data was not provided in the input; exploitation probability cannot be quantified independently. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, which distinguishes it from actively weaponized threats. However, the public availability of exploit code (E:P in the CVSS 4.0 supplemental vector and confirmed PoC references) lowers the bar for exploitation by less skilled actors. The most notable concern is that this flaw resides within a security product - a misconfigured DLL handler in antimalware software could be leveraged to tamper with the software's own protections, a higher-stakes scenario than a similar flaw in non-security software. Vendor non-response to coordinated disclosure is a compounding risk factor as no authoritative fix timeline exists.

A local attacker with a standard Windows user account on a machine running IObit Malware Fighter targets insecurely permissioned DLL files in the DLL Handler component, either reading sensitive data from those files or planting a malicious DLL in the handler's search path. Because the PoC is publicly available at https://nathan2.com/posts/iobit/ and https://github.com/nasawyer7/IObitDriverav, a script-kiddie-level actor could replicate the attack without advanced skills. If the handler loads the attacker-controlled DLL in the context of a privileged IObit service, the low integrity and availability impacts could escalate to service disruption or silent disabling of antimalware protection.