CVE-2020-36952CWE-428

IObit Uninstaller 10 Pro - Unquoted Service Path

High · published January 26, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
5.6
In the wild
Unconfirmed
What it is

⚡ An unquoted service path in IObit Uninstaller 10 Pro could let a local user execute code with SYSTEM-level privileges — and that’s a big deal! 🦸‍♂️ Think of it like a restaurant where the kitchen staff can walk straight through a door marked ‘Private’ without a password. If that door isn’t properly secured, anyone can enter and access the chef’s secrets! This vulnerability could allow an attacker to insert malicious code that runs with the highest permissions, potentially allowing them to take control of the entire system. Imagine a rogue chef manipulating all the recipes to serve up a disastrous meal!

Put simply

Think of it like a restaurant where the kitchen staff can walk straight through a door marked ‘Private’ without a password. If that door isn’t properly secured, anyone can enter and access the chef’s secrets! The unquoted service path vulnerability in IObit Uninstaller 10 Pro allows local users to exploit the service startup process by inserting malicious code that executes with elevated privileges, putting the system at risk.

What to do

This vulnerability could allow an attacker to insert malicious code that runs with the highest permissions, potentially allowing them to take control of the entire system. Imagine a rogue chef manipulating all the recipes to serve up a disastrous meal! To mitigate this risk, ensure that the IObit Uninstaller Service path is correctly quoted to prevent code injections. Additionally, update to the latest version to apply any patches that address this issue, and regularly audit local user permissions. You've got this! Follow these steps to secure your system and keep those cyber villains at bay! 🛡️

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00166 · 5.6th percentile
Weakness
CWE-428 · Unquoted Search Path or Element
Published
2026-01-26T16:00Z
EPSS history
Timeline
  • 26 JAN 16:00Z
    IObit Uninstaller 10 Pro - Unquoted Service Path
    cvelistv5