CVE-2026-12193: Revo Uninstaller Buffer Overflow Flaw

CVE-2026-12193 Overview

CVE-2026-12193 is a heap-based buffer overflow vulnerability affecting VS Revo RevoUninstaller versions 2.5.x and 2.6.x. The flaw resides in the IOCtl_Handler function within the RevoDetector.sys kernel driver, which exposes an IOCTL interface to user-mode callers. A local authenticated attacker can send a crafted IOCTL request to corrupt kernel pool memory.

The exploit code is publicly available on GitHub and has been documented in third-party write-ups. Successful exploitation results in memory corruption within the Windows kernel pool, which can be leveraged for local privilege escalation. The vendor addressed the issue in version 2.7.0.

Critical Impact
Local attackers with low privileges can corrupt kernel pool memory through the vulnerable IOCTL handler, enabling potential privilege escalation to SYSTEM on Windows hosts running affected RevoUninstaller versions.

Affected Products

VS Revo RevoUninstaller 2.5.x
VS Revo RevoUninstaller 2.6.x
RevoDetector.sys kernel driver component

Discovery Timeline

2026-06-15 - CVE-2026-12193 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12193

Vulnerability Analysis

The vulnerability lives in the IOCtl_Handler function inside RevoDetector.sys, the kernel-mode driver shipped with RevoUninstaller. The driver registers a device object that accepts I/O Control (IOCTL) requests from user mode. When the handler processes an attacker-supplied input buffer, it fails to validate length constraints before copying data into a kernel pool allocation.

This classifies as a heap-based buffer overflow under [CWE-119], improper restriction of operations within the bounds of a memory buffer. Kernel pool overflows are a well-understood primitive for privilege escalation on Windows because adjacent pool chunks contain object headers and function pointers that can be overwritten to redirect kernel control flow.

Root Cause

The root cause is missing or insufficient size validation in the IOCTL dispatch path of RevoDetector.sys. The handler trusts the caller-controlled length or copies data without bounding it against the destination buffer. Pool memory beyond the allocation boundary becomes attacker-controlled, corrupting adjacent kernel objects.

Attack Vector

Exploitation requires local access and low-privileged credentials on the target host. An attacker opens a handle to the vulnerable device exposed by RevoDetector.sys and issues a malformed DeviceIoControl request containing an oversized payload. Because the vulnerable code path runs in kernel context, successful exploitation can yield SYSTEM-level execution.

Proof-of-concept code is published in the RevoDetectorExploit GitHub repository and a pool overflow exploit analysis by Jordan Higgins documents the kernel pool grooming technique. Refer to these sources for the exploit primitive details; no synthetic code is reproduced here.

Detection Methods for CVE-2026-12193

Indicators of Compromise

Presence of RevoDetector.sys versions corresponding to RevoUninstaller 2.5.x or 2.6.x on Windows endpoints
Unexpected user-mode processes opening handles to the RevoDetector device object and issuing IOCTL requests
Windows kernel pool corruption bugchecks (BSOD) referencing RevoDetector.sys in the faulting module
Local privilege escalation events where a low-privileged process subsequently spawns SYSTEM-level children after interacting with the driver

Detection Strategies

Inventory installed software and driver versions across the fleet to flag any host running RevoUninstaller 2.5.x or 2.6.x with the vulnerable RevoDetector.sys loaded
Monitor kernel crash dumps and Windows Error Reporting (WER) telemetry for faults attributable to RevoDetector.sys
Hunt for sequences where a non-administrative process opens the RevoDetector device handle and immediately issues large or malformed IOCTL buffers

Monitoring Recommendations

Enable Windows Driver Verifier on hosts where the driver remains installed during testing to surface pool corruption earlier
Forward Sysmon Event ID 6 (driver loaded) and Event ID 1 (process create) to a central SIEM for correlation
Alert on integrity-level transitions where a Medium IL process gains SYSTEM context shortly after handle activity against vulnerable drivers

How to Mitigate CVE-2026-12193

Immediate Actions Required

Upgrade RevoUninstaller to version 2.7.0 or later on every affected Windows host
Identify and remove residual installations of 2.5.x and 2.6.x, including portable copies that may leave RevoDetector.sys registered
Restrict local logon and limit which standard users can install or run third-party uninstaller utilities

Patch Information

The vendor has released RevoUninstaller version 2.7.0, which remediates the heap-based buffer overflow in IOCtl_Handler. The fixed installer is available from the Revo Uninstaller download page. Additional vulnerability metadata is published on VulDB entry for CVE-2026-12193.

Workarounds

Uninstall RevoUninstaller entirely on systems where upgrading to 2.7.0 is not immediately feasible
Disable or unload the RevoDetector.sys driver via sc.exe to remove the attack surface until the host is patched
Apply application allowlisting policies (Windows Defender Application Control or AppLocker) to prevent execution of unauthorized exploit binaries on affected hosts

bash

# Configuration example: stop and disable the vulnerable driver service
sc.exe stop RevoDetector
sc.exe config RevoDetector start= disabled