IObit vulnerabilities
We track 8 vulnerabilities in IObit products across 7 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on May 5, 2026.
Latest IObit vulnerabilities
- 7.0 High severity
Advanced SystemCare: Improper Link Resolution Before File Access
A security flaw has been discovered in IObit Advanced SystemCare 19. This affects an unknown part of the file ASC.exe of the component Service. The manipulation results in symlink following. Attacking locally is a requirement. This attack is characterized by h
- 7.8 High severity
DualSafe Password Manager: Uncontrolled Search Path Element
A vulnerability classified as critical has been found in IObit DualSafe Password Manager 1.4.0.3. This affects an unknown part in the library RTL120.BPL of the component BPL Handler. The manipulation leads to uncontrolled search path. It is possible to launch
- 7.8 High severity
Driver Booster: Uncontrolled Search Path Element
A vulnerability was found in IObit Driver Booster 11.0.0.0. It has been rated as critical. Affected by this issue is some unknown functionality in the library VCL120.BPL of the component BPL Handler. The manipulation leads to uncontrolled search path. Attackin
- 7.8 High severity
iTop Data Recovery Pro: Uncontrolled Search Path Element
A vulnerability was found in IObit iTop Data Recovery Pro 4.4.0.687. It has been declared as critical. Affected by this vulnerability is an unknown functionality in the library madbasic_.bpl of the component BPL Handler. The manipulation leads to uncontrolled
- 7.8 High severity
Malware Fighter: Out-of-bounds Write
A vulnerability was found in IObit Malware Fighter 9.4.0.776. It has been declared as critical. This vulnerability affects the function 0x8018E000/0x8018E004 in the library IMFCameraProtect.sys of the component IOCTL Handler. The manipulation leads to stack-ba
- 7.8 High severity
Advanced System Care: Exposure of Resource to Wrong Sphere
In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that
- 7.8 High severity
Advanced Systemcare: Files or Directories Accessible to External Parties
IOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has "rwx" permissions for unprivileged users. Low privilege users can use SetOpLock to wait for CreateProcess
- 9.8 Critical severity
Iotransfer: Missing Authentication for Critical Functionality
In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote cod