Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.6
CVE-2026-82671: IObit Unlocker may let a local user gain extra rights
CVE-2026-82671 · published 2 months ago
Summary
The version 1.3.0.12 of IObit Unlocker contains a coding error that can let someone sitting at the computer obtain higher system privileges and stop programs they normally could not. This could be used to take control of the machine or interfere with other users' work. Apply any available updates from IObit or uninstall the program until a fix is released, and restrict local access to trusted users only.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| iobit | unlocker | 1.3.0.12 |
Original advisory text
IObit Unlocker IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTerminateProcess privileges management
A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in the library IObitUnlocker.sys of the component IRP_MJ_DEVICE_CONTROL Handler. The manipulation leads to improper privilege management. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-266Incorrect Privilege Assignment
CWE-269Improper Privilege Management
Timeline
Published31 Aug 2026
Updated26 Oct 2026
First seen31 Aug 2026
Track software like this
Free during beta