Iobit vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Iobit products: 8 record(s), with severity, exploitation and fixes.

Advanced System Care 2 Malware Fighter 2 IObit Uninstaller 2 Iobit Unlocker 1 Advanced System Care Service 1

Exploited only (KEV) →

CVE-2026-12201 Medium · 5.3 CWE-266 Jun 14, 2026

IObit Malware Fighter DLL permission

A flaw has been found in IObit Malware Fighter up to 13.2.0. Affected by this vulnerability is an unknown functionality of the component DLL Handler. This manipulation causes permission issues. The attack requires local access. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2020-37232 High · 7.8 CWE-428 May 16, 2026

Advanced System Care Service 13.0.0.157 Unquoted Service Path Privilege Escalation

Advanced System Care Service 13.0.0.157 contains an unquoted service path vulnerability in the AdvancedSystemCareService13 service binary path that allows local attackers to escalate privileges. Attackers can place malicious executables in the system root path that will be executed with LocalSystem privileges during service startup or system reboot.

CVE-2020-37223 High · 7.8 CWE-428 May 13, 2026

IObit Uninstaller 9.5.0.15 Unquoted Service Path Privilege Escalation

IObit Uninstaller 9.5.0.15 contains an unquoted service path vulnerability in the IObitUnSvr service that allows local attackers to escalate privileges to SYSTEM level. Attackers can place a malicious executable named IObit.exe in the C:\Program Files (x86)\IObit directory and restart the service to execute code with SYSTEM privileges.

CVE-2026-7832 High · 7.0 CWE-59 May 5, 2026

IObit Advanced SystemCare Service ASC.exe symlink

A security flaw has been discovered in IObit Advanced SystemCare 19. This affects an unknown part of the file ASC.exe of the component Service. The manipulation results in symlink following. Attacking locally is a requirement. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks.

CVE-2016-20059 High · 7.8 CWE-428 Apr 4, 2026

IObit Malware Fighter 4.3.1 Unquoted Service Path Privilege Escalation

IObit Malware Fighter 4.3.1 contains an unquoted service path vulnerability in the IMFservice and LiveUpdateSvc services that allows local attackers to escalate privileges. Attackers can insert a malicious executable file in the unquoted service path and trigger privilege escalation when the service restarts or the system reboots, executing code with LocalSystem privileges.

CVE-2016-20055 High · 7.8 CWE-428 Apr 4, 2026

IObit Advanced SystemCare 10.0.2 Unquoted Service Path Privilege Escalation

IObit Advanced SystemCare 10.0.2 contains an unquoted service path vulnerability in the AdvancedSystemCareService10 service that allows local attackers to escalate privileges. Attackers can place a malicious executable in the service path and trigger privilege escalation when the service restarts or the system reboots, executing code with LocalSystem privileges.

CVE-2025-66676 Medium · 6.2 CWE-400 Feb 13, 2026

Uncontrolled Resource Consumption in Iobit Iobit Unlocker

An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.

CVE-2020-36952 High · 7.8 CWE-428 Jan 26, 2026

IObit Uninstaller 10 Pro - Unquoted Service Path

IObit Uninstaller 10 Pro contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted service path in the IObit Uninstaller Service to insert malicious code that would execute with SYSTEM-level permissions during service startup.