CVE-2026-90485: IOBit Uninstaller Use-After-Free Flaw

CVE-2026-90485 Overview

CVE-2026-90485 is a null pointer dereference vulnerability in IObit Uninstaller 15.5.0.11. The flaw resides in function sub_11838 within the IURegistryFilter.sys kernel driver, specifically in the IOCTL Dispatch Handler component. An attacker with local access can send crafted I/O control requests that cause the driver to dereference a null pointer, resulting in a kernel-mode crash and denial of service. The same IURegistryFilter.sys binary ships across multiple IObit product families, expanding the exposure. A public exploit exists, and the vendor did not respond to disclosure attempts.

Critical Impact
Local attackers can trigger a kernel null pointer dereference in IURegistryFilter.sys, causing a system crash (BSOD) on hosts running affected IObit products.

Affected Products

IObit Uninstaller 15.5.0.11
Additional IObit product families shipping the identical IURegistryFilter.sys driver
Windows hosts with the vulnerable driver loaded

Discovery Timeline

2026-09-12 - CVE-2026-90485 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90485

Vulnerability Analysis

The vulnerability is classified as improper resource shutdown or release [CWE-404] and manifests as a null pointer dereference inside a kernel-mode driver. When a user-mode process issues an IOCTL to IURegistryFilter.sys, the dispatch handler routes execution to sub_11838. This function operates on a pointer that can be null under attacker-controlled input conditions. Dereferencing that pointer in ring 0 triggers a bug check and takes the host offline.

Because IURegistryFilter.sys is loaded during normal IObit product operation, any authenticated local user with permission to open the driver device object can invoke the vulnerable IOCTL. A public proof of concept has been released, lowering the barrier to reliable exploitation.

Root Cause

The root cause is missing input validation on parameters or object references handled by sub_11838 before dereference. The function does not confirm that the target pointer is non-null prior to use. Combined with an accessible IOCTL interface exposed by IURegistryFilter.sys, this permits unprivileged callers to reach a code path that must instead be gated by strict validation.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker opens a handle to the driver's device object, then issues a malformed DeviceIoControl request targeting the vulnerable dispatch path. The kernel crashes with a bug check, forcing an unplanned reboot. The vulnerability does not directly grant code execution or privilege escalation, but it enables reliable local denial of service against any host running the driver.

No verified code example is available. Refer to the VulDB entry for CVE-2026-90485 and the VulDB vulnerability record #403064 for technical details on the published exploit.

Detection Methods for CVE-2026-90485

Indicators of Compromise

Unexpected BugCheck events (Event ID 1001) in the Windows System log referencing IURegistryFilter.sys
Crash dump files under C:\Windows\Minidump\ implicating the IObit registry filter driver
Non-administrative processes opening handles to the IURegistryFilter device object followed by immediate system crash

Detection Strategies

Hunt for processes issuing DeviceIoControl calls to \\.\IURegistryFilter from non-IObit binaries
Correlate driver load events for IURegistryFilter.sys with subsequent unexpected reboots on the same host
Alert on repeated kernel bug checks across an endpoint fleet where the faulting module is the IObit driver

Monitoring Recommendations

Forward Windows kernel crash telemetry and WER reports to a central log store for fleet-wide analysis
Track installation and load events for IURegistryFilter.sys across managed endpoints
Monitor for public proof-of-concept binaries or scripts referencing IObit driver IOCTL codes

How to Mitigate CVE-2026-90485

Immediate Actions Required

Inventory all endpoints running IObit Uninstaller 15.5.0.11 and any IObit product shipping IURegistryFilter.sys
Restrict local logon rights on servers and shared workstations to reduce the population of users able to trigger the flaw
Prioritize removal of IObit software on high-availability systems where kernel crashes cause operational impact

Patch Information

At the time of disclosure, no vendor patch is available. VulDB records indicate the vendor was contacted about this issue but did not respond. Monitor the VulDB CVE-2026-90485 entry and IObit's official support channels for future updates.

Workarounds

Uninstall affected IObit products until a patched version is released
If uninstalling is not feasible, disable the IURegistryFilter service and unload the driver to remove the attack surface
Enforce application allowlisting to prevent unauthorized binaries from opening handles to the vulnerable driver
Apply least-privilege policies so that only trusted administrative accounts can interact with kernel driver interfaces

bash

# Disable the vulnerable driver service (run as Administrator)
sc.exe query IURegistryFilter
sc.exe stop IURegistryFilter
sc.exe config IURegistryFilter start= disabled