Description

A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub_11838 of the file IURegistryFilter.sys of the component IOCTL Dispatch Handler. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been published and may be used. Identical IURegistryFilter.sys ships across multiple IObit families. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-12T22:16:30.783Z",
  "pubdate": "2026-09-12T22:16:30.783Z",
  "executiveSummary": "A critical vulnerability exists in the IURegistryFilter.sys driver component of IOBit Uninstaller 15.5.0.11, manifesting as a null pointer dereference within the IOCTL Dispatch Handler.\nThis flaw allows a local attacker to trigger a system-level crash or potentially execute arbitrary code by manipulating input passed to the affected function.\nThe vulnerability resides within the kernel-mode driver, which is shared across multiple IObit software products, widening the potential attack surface.\nExploitation requires local access to the target system, and proof-of-concept exploit code has been publicly disclosed.\nGiven that the driver operates with kernel-level privileges, successful exploitation poses a significant risk to system stability and security, potentially leading to a Denial of Service (DoS) or complete system compromise.\nThe vendor has been notified of the vulnerability but has remained unresponsive, leaving users without an official patch or remediation guidance.",
  "technicalDetails": "The vulnerability is located in the IURegistryFilter.sys driver, specifically within the sub_11838 function, which acts as a handler for I/O Control (IOCTL) requests.\nThe root cause is an improper validation of user-supplied data during the IOCTL dispatch process. Specifically, the function fails to verify the integrity or existence of a pointer before attempting to dereference it, leading to a null pointer dereference condition.\nThe attack flow begins with a local authenticated user interacting with the IURegistryFilter.sys device object. By crafting a specific IOCTL request containing a null or invalid pointer, the attacker influences the execution path of the sub_11838 function.\nWhen the kernel-mode driver processes this malicious request, it executes an operation on the null pointer. Because this occurs within the kernel context, the operating system kernel cannot safely handle the memory violation, resulting in an immediate system bug check (BSOD).\nBeyond a standard Denial of Service (DoS) attack, vulnerabilities involving improper pointer handling in kernel drivers often provide primitives for further exploitation. If the null pointer dereference can be leveraged to map memory at address 0x0, an attacker might be able to redirect control flow to attacker-controlled shellcode or execute return-oriented programming (ROP) chains.\nBecause the IURegistryFilter.sys driver is utilized across various IObit product families, the exposure is not limited solely to IOBit Uninstaller 15.5.0.11. Any system with this driver installed is inherently vulnerable to the same exploitation vector.\nThe vulnerability requires local access, meaning an attacker must already have a foothold on the target machine, such as through a standard user account. Once access is obtained, the attacker can leverage the driver's elevated status to bypass traditional user-mode protections."
}