CVE-2026-82670: IObit Uninstaller Privilege Escalation

CVE-2026-82670 Overview

CVE-2026-82670 is an improper privilege management flaw in IObit Uninstaller 15.5.0.11. The vulnerability resides in the IRP_MJ_DEVICE_CONTROL function within the IUForceDelete.sys kernel driver. Local attackers can manipulate IOCTL (I/O Control) requests handled by the driver to achieve improper privilege management [CWE-266]. The flaw requires local access with low privileges and no user interaction. According to VulDB, the vendor was contacted about this disclosure but did not respond.

Critical Impact

Local low-privileged users can abuse the IUForceDelete.sys IOCTL handler in IObit Uninstaller 15.5.0.11 to perform privileged operations that should be restricted to administrators.

Affected Products

• IObit Uninstaller 15.5.0.11
• Component: IUForceDelete.sys kernel driver
• Function: IRP_MJ_DEVICE_CONTROL (IOCTL Handler)

Discovery Timeline

• 2026-08-31 - CVE-2026-82670 published to NVD
• 2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82670

Vulnerability Analysis

The flaw exists in the IOCTL dispatch routine of the IUForceDelete.sys driver shipped with IObit Uninstaller 15.5.0.11. The IRP_MJ_DEVICE_CONTROL major function handles I/O request packets (IRPs) sent from user mode through DeviceIoControl calls. The driver does not adequately restrict which callers can invoke privileged operations, resulting in improper privilege management as classified under [CWE-266].

An attacker with local low-privileged access to a Windows host running the affected version can open a handle to the device object exposed by the driver and issue crafted IOCTLs. Because the kernel driver executes in ring 0, operations it exposes through IOCTLs run with SYSTEM-level capability regardless of the caller's token.

Root Cause

The root cause is missing or insufficient access control on privileged operations exposed through the IRP_MJ_DEVICE_CONTROL handler. The driver trusts the requesting process without enforcing appropriate authorization checks before performing sensitive actions such as forced file deletion.

Attack Vector

Exploitation requires local access and low privileges. No user interaction is required. An attacker executes code on the target system, opens a handle to the driver's device object, and issues one or more crafted IOCTL requests to trigger the privileged behavior. The disclosure references from VulDB provide additional cyber threat intelligence context; see the VulDB CVE-2026-82670 entry and VulDB Vulnerability #397169 for details.

No verified public proof-of-concept code has been released. The vulnerability mechanism is described in prose because no validated exploit source is available.

Detection Methods for CVE-2026-82670

Indicators of Compromise

• Presence of IUForceDelete.sys loaded on hosts running IObit Uninstaller 15.5.0.11.
• User-mode processes opening handles to the IObit driver device object followed by DeviceIoControl calls from non-administrative accounts.
• Unexpected deletion of protected files or files owned by SYSTEM initiated indirectly through the driver.

Detection Strategies

• Monitor kernel driver load events (Windows Event ID 6, Sysmon Event ID 6) for IUForceDelete.sys on endpoints where installation is not authorized.
• Baseline which processes legitimately interact with the IObit Uninstaller device object and alert on deviations.
• Correlate low-privileged process activity with subsequent SYSTEM-level file operations to identify privilege abuse patterns.

Monitoring Recommendations

• Track file operations targeting sensitive directories immediately following IOCTL activity against the IObit driver.
• Audit installations of IObit Uninstaller across the environment and flag version 15.5.0.11.
• Forward driver load and process telemetry to a centralized analytics platform for retrospective hunting.

How to Mitigate CVE-2026-82670

Immediate Actions Required

• Inventory endpoints running IObit Uninstaller 15.5.0.11 and identify systems where the IUForceDelete.sys driver is loaded.
• Restrict local access on affected hosts and enforce least privilege for interactive users.
• Remove IObit Uninstaller 15.5.0.11 from systems where it is not business-critical until a fixed version is available.

Patch Information

No vendor patch has been published at the time of writing. According to the VulDB disclosure, the vendor was contacted but did not respond. Consult the VulDB advisory for updated remediation status.

Workarounds

• Uninstall IObit Uninstaller 15.5.0.11 on systems that do not require it.
• Block loading of the IUForceDelete.sys driver using Windows Defender Application Control (WDAC) or a driver blocklist policy.
• Enforce standard user accounts and application allowlisting to reduce the pool of local actors capable of triggering the IOCTL.
• Use endpoint protection to alert on non-administrative processes opening privileged device handles.