CVE-2026-90485CWE-404CWE-476

CVE-2026-90485

Medium · published September 13, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub_11838 of the file IURegistryFilter.sys of the component IOCTL Dispatch Handler. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been published and may be used. Identical IURegistryFilter.sys ships across multiple IObit families. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
6.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00166 · 5.5th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2026-09-13T02:16Z
References (5)
https://vuldb.com/cve/CVE-2026-90485 · [email protected]https://vuldb.com/submit/887954 · [email protected]https://vuldb.com/vuln/403064 · [email protected]https://vuldb.com/vuln/403064/cti · [email protected]https://vuldb.com/submit/887954 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 12 SEP 21:15Z
    IOBit Uninstaller IOCTL Dispatch IURegistryFilter.sys sub_11838 null pointer dereference
    cvelistv5