CVE-2025-26125: IObit Malware Fighter Privilege Escalation

CVE-2025-26125 Overview

CVE-2025-26125 is a local privilege escalation vulnerability in IObit Malware Fighter v12.1.0. The flaw resides in the IMFForceDelete kernel driver, which exposes an I/O control (IOCTL) interface without adequate access controls. Attackers with local user access can invoke the exposed IOCTL to arbitrarily delete files on the host system. Because the driver operates in kernel context, arbitrary file deletion can be leveraged to remove security-critical files and escalate privileges to SYSTEM. The weakness is classified under [CWE-782: Exposed IOCTL with Insufficient Access Control].

Critical Impact
A local attacker can abuse the IMFForceDelete driver to delete arbitrary files and achieve SYSTEM-level privilege escalation on Windows endpoints running IObit Malware Fighter v12.1.0.

Affected Products

IObit Malware Fighter v12.1.0
IMFForceDelete kernel driver shipped with the affected release
Windows endpoints where the vulnerable driver is installed and loaded

Discovery Timeline

2025-03-17 - CVE-2025-26125 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26125

Vulnerability Analysis

The IMFForceDelete driver is a Windows kernel-mode component used by IObit Malware Fighter to forcibly remove files that user-mode processes cannot delete. To provide this functionality, the driver exposes an IOCTL handler that accepts a target file path from user mode and deletes the referenced file with kernel privileges.

The vulnerable IOCTL does not validate the identity or privilege level of the calling process, and it does not restrict which files can be targeted. Any local user able to open a handle to the driver's device object can issue the IOCTL and request deletion of any file on the file system, including files owned by SYSTEM.

Exploitation requires local access and some user interaction, but no elevated privileges. Public proof-of-concept code is available in the ZeroMemoryEx CVE-2025-26125 repository and the related IObit-EoP repository.

Root Cause

The root cause is an exposed IOCTL with insufficient access control on a privileged kernel driver [CWE-782]. The driver's device object permissions and IOCTL dispatch routine fail to enforce caller privilege checks or restrict the set of files eligible for deletion.

Attack Vector

An attacker running as a standard user opens a handle to the IMFForceDelete device and sends a crafted DeviceIoControl request containing the path to a target file. Attackers commonly chain arbitrary file deletion primitives with Windows Installer rollback techniques or DLL planting to escalate from a low-privileged account to SYSTEM. Additional technical context is documented by the researcher on X (formerly Twitter).

No synthetic exploitation code is reproduced here. Refer to the linked public proof-of-concept repositories for verified technical details.

Detection Methods for CVE-2025-26125

Indicators of Compromise

Presence of the IMFForceDelete.sys driver on endpoints running IObit Malware Fighter v12.1.0
Unexpected deletion of files in protected directories such as C:\Windows\System32 or C:\Program Files
Handles opened to the IMFForceDelete device object by non-IObit processes
Creation of a new SYSTEM-level process shortly after suspicious file deletion activity

Detection Strategies

Monitor kernel driver load events (Sysmon Event ID 6) for IMFForceDelete.sys on hosts where IObit Malware Fighter is not authorized
Alert on user-mode processes issuing DeviceIoControl calls against the IObit device object outside of the vendor's own binaries
Correlate arbitrary file deletion events in security-sensitive paths with subsequent privilege escalation or service manipulation activity

Monitoring Recommendations

Enable file integrity monitoring on Windows system directories and installed security product paths
Ingest driver load, process creation, and file deletion telemetry into a centralized SIEM for correlation
Track parent-child process relationships for unexpected SYSTEM-level child processes spawned from standard user sessions

How to Mitigate CVE-2025-26125

Immediate Actions Required

Inventory all endpoints for IObit Malware Fighter v12.1.0 and identify installations of the IMFForceDelete driver
Upgrade to a fixed release of IObit Malware Fighter once the vendor publishes a patched version
Restrict local user access on systems where the vulnerable driver cannot be immediately removed
Apply application control policies to block untrusted binaries from interacting with the vulnerable device object

Patch Information

No vendor advisory URL is present in the enriched CVE data at time of publication. Administrators should consult IObit's official product update channels for a fixed release of Malware Fighter that remediates CVE-2025-26125 and either removes or hardens the IMFForceDelete driver's IOCTL interface.

Workarounds

Uninstall IObit Malware Fighter v12.1.0 on systems where a patched version is not yet available
Use Microsoft's vulnerable driver blocklist or Windows Defender Application Control (WDAC) to prevent loading of the affected IMFForceDelete.sys driver
Limit interactive logon rights on affected hosts to reduce the population of users who can invoke the exposed IOCTL

bash

# Example: query for the vulnerable driver on a Windows host
sc.exe query IMFForceDelete
where /R C:\Windows\System32\drivers IMFForceDelete.sys