Uninstaller
Monthly
IURegistryFilter.sys, the kernel-mode registry filter driver bundled with IOBit Uninstaller 15.5.0.11, can be crashed by any local low-privileged user by sending a crafted IOCTL to the sub_11838 dispatch handler, which dereferences a null pointer in kernel context and produces a system-wide crash (BSOD). The attack surface is broader than a single product: the advisory explicitly states that the identical IURegistryFilter.sys driver ships across multiple other IObit product families, meaning all such products on an affected host are vectors. A published proof-of-concept exploit exists (CVSS 4.0 E:P), and no vendor patch is available - the vendor did not respond to coordinated disclosure.
Privilege management failure in IObit Uninstaller 15.5.0.11's kernel driver IUForceDelete.sys allows a local low-privileged user to send crafted IOCTL requests to the IRP_MJ_DEVICE_CONTROL handler and trigger improper privilege operations, resulting in limited integrity and availability impact on the local Windows system. The vendor did not respond to coordinated disclosure, leaving no vendor-issued patch or official mitigation guidance available. No public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
IURegistryFilter.sys, the kernel-mode registry filter driver bundled with IOBit Uninstaller 15.5.0.11, can be crashed by any local low-privileged user by sending a crafted IOCTL to the sub_11838 dispatch handler, which dereferences a null pointer in kernel context and produces a system-wide crash (BSOD). The attack surface is broader than a single product: the advisory explicitly states that the identical IURegistryFilter.sys driver ships across multiple other IObit product families, meaning all such products on an affected host are vectors. A published proof-of-concept exploit exists (CVSS 4.0 E:P), and no vendor patch is available - the vendor did not respond to coordinated disclosure.
Privilege management failure in IObit Uninstaller 15.5.0.11's kernel driver IUForceDelete.sys allows a local low-privileged user to send crafted IOCTL requests to the IRP_MJ_DEVICE_CONTROL handler and trigger improper privilege operations, resulting in limited integrity and availability impact on the local Windows system. The vendor did not respond to coordinated disclosure, leaving no vendor-issued patch or official mitigation guidance available. No public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog at time of analysis.