A local privilege escalation vulnerability in IObit Uninstaller 10 allows authenticated users to execute arbitrary code with SYSTEM-level permissions.

The application is susceptible to an unquoted service path flaw (CWE-428) in the IObit Uninstaller Service, which fails to enclose the executable path in quotes. Because the path contains spaces, a local attacker can place a malicious executable in a parent directory to hijack the service startup and gain elevated SYSTEM privileges.

Successful exploitation of this vulnerability grants an attacker full control over the affected Windows host. Given that the service runs with SYSTEM-level privileges, an attacker can bypass all local security restrictions, install persistent backdoors, or exfiltrate sensitive data. With a CVSS score of 7.8, this represents a significant risk to the integrity and confidentiality of any machine where the software is installed.

Immediate Action: Update IObit Uninstaller to the latest available version provided by the vendor to ensure the service path is properly quoted.

Proactive Monitoring: Monitor system logs for unexpected service creation events or unauthorized file modifications in the C:\Program Files (x86)\IObit\ directory.

Compensating Controls: If an immediate update is not feasible, manually modify the service configuration to enclose the binary path in quotes, or restrict write permissions to the installation directory to prevent the placement of malicious binaries.

Public Exploit Available: Yes, a proof of concept is available via the Exploit Database (EDB-ID 49371).

This vulnerability presents a high risk due to the ease of privilege escalation. Organizations should prioritize updating all instances of IObit Uninstaller 10 to a patched version immediately. If updates cannot be applied, administrators must restrict folder permissions to prevent non-privileged users from writing files to the application path.