Description

A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUForceDelete.sys of the component IOCTL Handler. Executing a manipulation can lead to improper privilege management. The attack requires local access. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-31T10:16:50.420Z",
  "pubdate": "2026-08-31T10:16:50.420Z",
  "executiveSummary": "A critical vulnerability categorized as improper privilege management exists within the IObit Uninstaller 15.5.0.11 utility. Specifically, the flaw resides in the kernel-mode driver IUForceDelete.sys, which provides functionality for forced file deletion.\nThe vulnerability manifests within the IRP_MJ_DEVICE_CONTROL dispatch routine of the IOCTL handler. An attacker with local access to the target system can exploit this weakness to perform unauthorized operations, potentially bypassing standard OS security controls.\nThe risk implication is significant as it allows a local, low-privileged user to interact with the vulnerable driver to escalate privileges or perform unauthorized system modifications that would normally be restricted by Windows access control mechanisms.\nBecause the vendor has remained unresponsive to disclosure attempts, no official security patch is currently available. Exploitation requires the attacker to already possess local access to the system, meaning this is primarily a post-compromise or malicious insider threat vector.",
  "technicalDetails": "The vulnerability is situated within the kernel-mode driver IUForceDelete.sys, which is utilized by IObit Uninstaller 15.5.0.11. The driver exposes an IOCTL (Input/Output Control) interface via the IRP_MJ_DEVICE_CONTROL dispatch routine to facilitate the forced deletion of files that are otherwise locked by the operating system or other processes.\nThe root cause of the vulnerability is the implementation of insufficient validation or improper privilege checks within the IOCTL handler. When a user-mode application sends an I/O request packet (IRP) to the device object associated with IUForceDelete.sys, the driver fails to adequately verify the caller's integrity or required privilege level before executing the underlying kernel-mode operation. This allows an unprivileged process to communicate directly with the driver and leverage its elevated kernel-mode execution context.\nExploitation involves an attacker crafting a malicious payload that communicates with the device object exposed by the driver (typically found via a symbolic link). By sending specially formatted IOCTL requests to the device handle, the attacker can manipulate the driver's logic. Given that the driver operates with Kernel-mode privileges, it performs actions on behalf of the attacker without enforcing proper access control, effectively granting the attacker the ability to perform operations equivalent to the driver's privilege level.\nThe attack flow proceeds as follows: 1) The attacker initiates an local session on the target machine. 2) The attacker gains a handle to the vulnerable driver's device object. 3) The attacker identifies the specific IOCTL codes processed by the IRP_MJ_DEVICE_CONTROL routine. 4) The attacker sends a crafted buffer to the driver via DeviceIoControl. 5) The driver, lacking proper input sanitization or caller verification, processes the request. 6) The driver executes high-privilege operations in kernel mode, resulting in successful privilege escalation or unauthorized file manipulation. The post-exploitation impact includes the potential for system-wide compromise, modification of protected system files, and complete bypass of local security policies, as the kernel-mode execution allows the attacker to circumvent User Account Control (UAC) and integrity level restrictions."
}