IOBit Uninstaller CVE-2026-90485

Exploitation requires a local Windows session with a low-privileged (standard) user account on a host where IOBit Uninstaller or another IObit product that loads IURegistryFilter.sys is installed, and the driver must be currently loaded in the kernel (which occurs automatically on product install under normal conditions). The ability to open a handle to a kernel device object and issue IOCTL calls is available to any authenticated local user by default on Windows - no special permissions, group memberships, or elevated tokens are needed. No network access is required and there is no remote exploitation path. Exploitation is strictly limited to local denial of service (forced BSOD/reboot); no confidentiality or integrity impact applies. Remote or unauthenticated exploitation is not possible given the AV:L/PR:L CVSS vector.

Real-world risk is moderate. The CVSS 4.0 base score of 6.8 (AV:L/AC:L/AT:N/PR:L/UI:N/VA:H) accurately reflects the threat model: local, low-privilege, no interaction required, but availability-only impact. Any standard Windows user account on a host with an IOBit product installed can force a system crash at will. The E:P supplemental metric confirms public proof-of-concept code is available, lowering the skill threshold for exploitation. There is no KEV listing and no EPSS value provided in the input - the threat is opportunistic insider abuse or malware persistence disruption rather than targeted remote attack. The absence of confidentiality or integrity impact (VC:N/VI:N) limits severity; this is a denial-of-service primitive, not an escalation or data-theft path. The shared-driver claim, if accurate, multiplies the affected install base beyond Uninstaller alone - this is stated in the advisory but specific additional IOBit family names and version ranges are unconfirmed. Vendor non-responsiveness eliminates the possibility of an imminent patch.

A standard user account on a Windows machine with any IObit product installed opens a handle to the IURegistryFilter.sys device object using CreateFile and sends a specially crafted IOCTL payload targeting the sub_11838 handler. The handler dereferences a null pointer in kernel context, triggering an immediate BSOD and forcing a system reboot. A published proof-of-concept makes this reproducible with minimal technical skill; an attacker or malware could loop this to prevent the system from staying online.