CVE-2025-26125 PoC — IOBit Malware Fighter 安全漏洞

Source

https://github.com/ZeroMemoryEx/CVE-2025-26125

Associated Vulnerability

Title: IOBit Malware Fighter 安全漏洞 (CVE-2025-26125)
Description:An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges.

Description

(0day) Local Privilege Escalation in IObit Malware Fighter

Readme

# Description

* The PoC program exploits the IMFForceDelete driver which exposes an ioctl that allows unprivileged users to delete files and folders. We can turn this into a privilege escalation by using a technique explained by ZDI and Halov, which exploits the MSI rollback mechanism which is designed to maintain system integrity in case of issues. By deleting and recreating it with a weak DACL and fake RBF and RBS files we can gain the ability to make arbitrary changes to the system as NT AUTHORITY\SYSTEM.
  
# VID

https://github.com/user-attachments/assets/58e343d2-97a4-4ca3-9deb-df911b717a57

# CREDITS

* [Halov](https://x.com/KLINIX5)
* [ZDI](https://www.zerodayinitiative.com/blog/2022/3/16/abusing-arbitrary-file-deletes-to-escalate-privilege-and-other-great-tricks-archive)
* [vx-underground and #ifndef hjonk](https://x.com/vxunderground/status/1876670819411407188)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →