Description

A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in the library IObitUnlocker.sys of the component IRP_MJ_DEVICE_CONTROL Handler. The manipulation leads to improper privilege management. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.4",
  "pubDate": "2026-08-31T10:16:50.603Z",
  "pubdate": "2026-08-31T10:16:50.603Z",
  "executiveSummary": "A vulnerability classified as improper privilege management exists in IObit Unlocker version 1.3.0.12. The flaw resides within the IObitUnlocker.sys kernel-mode driver, specifically affecting the IRP_MJ_DEVICE_CONTROL handler function. This vulnerability allows a local, authenticated attacker to interact with the driver to perform unauthorized operations, potentially leading to privilege escalation.\nThe core issue stems from insecure handling of process termination requests via the ZwTerminateProcess function. Because the driver operates with kernel-level privileges (Ring 0), an attacker capable of crafting specific IOCTL (Input/Output Control) requests can command the driver to terminate arbitrary processes, including those running with SYSTEM or elevated security contexts. This flaw does not require network access, as it is strictly a local attack vector; however, the impact is significant, as it can be leveraged to bypass security mechanisms, terminate antivirus or endpoint detection services, or disrupt critical system stability.\nThe vendor has been notified of the vulnerability but has remained unresponsive. Consequently, no official patch is currently available. Users are advised to limit local account privileges and monitor system activity for anomalous process termination requests originating from the IObitUnlocker.sys driver.",
  "technicalDetails": "The vulnerability is situated within the IObitUnlocker.sys kernel driver, a component designed to unlock files that are otherwise inaccessible due to being held by system processes. The flaw occurs within the IRP_MJ_DEVICE_CONTROL dispatch routine, which manages communication between user-mode applications and the kernel-mode driver.\nThe root cause is an improper validation of user-supplied parameters passed to the driver. When the IRP_MJ_DEVICE_CONTROL handler is invoked via the DeviceIoControl API, the driver fails to adequately verify the intent and the target of the requested operation. Specifically, the driver facilitates the invocation of the ZwTerminateProcess kernel function, which is responsible for terminating a specified process handle. Because the driver does not enforce strict access control lists (ACLs) or validate that the calling user has the necessary permissions to terminate the target process, an attacker can supply an arbitrary process handle or PID to the driver.\nThe exploitation flow begins with an attacker obtaining a handle to the device object created by IObitUnlocker.sys (typically found in the Object Manager). Once the handle is obtained, the attacker can use the DeviceIoControl function to transmit a specially crafted IOCTL code to the driver. This payload includes the target process information required by the vulnerable function.\nUpon receiving the malicious IOCTL request, the IObitUnlocker.sys driver processes the input buffer without sufficient security checks. It then executes the ZwTerminateProcess function within the kernel context, passing the attacker-controlled process identifier. Since the driver is running at the highest privilege level (Ring 0), the system executes the termination request regardless of the caller's actual privilege level. This grants the attacker the ability to terminate any process that the driver has the capability to target, effectively bypassing standard Windows security boundaries and Mandatory Integrity Control (MIC) levels.\nSuccessful exploitation results in the unauthorized termination of processes, which can be used to disable security products, crash protected services, or clear the way for subsequent privilege escalation attacks. Because the driver's interface is accessible from a low-privileged local user context, the barrier to exploitation is minimal, requiring only the ability to open the device handle and communicate via IOCTL."
}