IObit Unlocker CVE-2026-82671

Exploitation requires local interactive or remote desktop access to the target Windows system with IObit Unlocker 1.3.0.12 installed and the IObitUnlocker.sys driver loaded in the kernel. The CVSS 4.0 vector specifies PR:H, confirming that the attacker must already possess high (administrator-level) privileges on the system - this is not a privilege escalation from standard user to admin, but rather an abuse of kernel driver access by an already-privileged account. Exploitation is constrained to the IRP_MJ_DEVICE_CONTROL IOCTL interface, reachable only via the Windows DeviceIoControl API directed at the IObit driver device object. There is no remote exploitation path (AV:L). Limiting factors include: the requirement for existing admin access, the need for the IObit Unlocker software to be installed and the driver loaded, and the absence of any cross-network attack surface. The affected system must be running Windows, as IObitUnlocker.sys is a Windows kernel driver.

The CVSS 4.0 base score of 4.6 (Medium) accurately reflects the constrained threat model. The attack vector is strictly local (AV:L), and the CVSS vector specifies PR:H - meaning the attacker must already hold administrator-level privileges before exploitation is possible. With no confidentiality impact (VC:N) and only Low integrity and availability impact (VI:L/VA:L), the vulnerability does not enable direct data exfiltration or system compromise beyond process termination. No EPSS probability data was provided, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The 'Privilege Escalation' tag in the metadata is potentially misleading: the CVSS vector does not support lateral privilege gain from a lower-privilege account; rather, an already high-privileged user can abuse the driver's IOCTL interface to extend their effective reach into process termination in ways the OS would otherwise restrict. The primary real-world risk is abuse by malicious insiders or malware already running with admin rights - for example, to disable endpoint detection and response (EDR) agents or security software protected by anti-tamper mechanisms. The absence of a vendor patch (vendor did not respond to disclosure) is the most actionable concern for defenders.

A local attacker already holding administrator privileges on a Windows system with IObit Unlocker 1.3.0.12 installed opens a handle to the IObitUnlocker.sys device object and sends a crafted IOCTL through the DeviceIoControl API targeting the IRP_MJ_DEVICE_CONTROL handler. The handler invokes ZwTerminateProcess without performing adequate privilege validation, allowing the attacker to terminate a protected process - such as an endpoint security agent or EDR sensor - that would normally resist termination even from an admin account. No public exploit code has been identified at time of analysis.