CVE-2026-82671CWE-266CWE-269privilege-escalation

CVE-2026-82671

Low · published August 31, 2026

CVSS v3.1
3.4
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in the library IObitUnlocker.sys of the component IRP_MJ_DEVICE_CONTROL Handler. The manipulation leads to improper privilege management. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
3.4 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
4.6 · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00158 · 4.6th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-269 · Improper Privilege Management
Published
2026-08-31T14:16Z
References (4)
https://vuldb.com/cve/CVE-2026-82671 · [email protected]https://vuldb.com/submit/893879 · [email protected]https://vuldb.com/vuln/397170 · [email protected]https://vuldb.com/vuln/397170/cti · [email protected]
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 31 AUG 09:45Z
    IObit Unlocker IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTerminateProcess privileges management
    cvelistv5