IObit Uninstaller CVE-2026-82670

IObit Uninstaller 15.5.0.11 must be installed on the target Windows system and the IUForceDelete.sys driver must be in a loaded state, which occurs during normal application use. The attacker must have local, interactive or programmatic access to the system with at minimum a standard low-privileged Windows user account (consistent with CVSS PR:L). No network access, user interaction from a higher-privileged user, or elevated account rights are required. Exploitation is strictly bounded to local access - remote or unauthenticated attack paths are not present. Systems where IObit Uninstaller is absent, or where the driver is blocked from loading via allowlist policy, are not exposed.

The CVSS 4.0 score of 4.8 (Medium) accurately reflects a constrained attack surface: exploitation requires local access (AV:L), low privilege (PR:L), and no special attack conditions (AT:N). Impact is bounded to limited integrity and availability at the vulnerable-system level (VI:L/VA:L) with no confidentiality exposure or scope change to subsequent systems. No EPSS score is available in the source data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, meaning real-world exploitation probability is presently low. However, the vendor's complete failure to respond to disclosure substantially elevates residual risk: there is no patch, no official timeline, and no vendor-confirmed mitigation - organizations cannot rely on a forthcoming fix. For environments where IUForceDelete.sys is actively loaded, even the bounded CVSS impact underscores the value of auditing whether this driver is present, since kernel-level IOCTL abuse can be a stepping stone in multi-stage local privilege escalation chains beyond what the isolated CVSS metrics capture.

A local user with a standard Windows account on a system running IObit Uninstaller 15.5.0.11 opens a handle to the device exposed by IUForceDelete.sys and sends a crafted IOCTL control code or malformed input buffer to the IRP_MJ_DEVICE_CONTROL handler. The driver's failure to enforce proper privilege checks allows the IOCTL operation to execute with elevated permissions, producing limited write or availability impact within the kernel context. No public proof-of-concept exploit has been identified, so practical exploitation currently requires reverse engineering of the driver binary to identify the triggerable control codes.