CVE-2016-20059

HighCVSS 7.8

Published: 04/04/2026(UTC)Updated: 21/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

IObit Malware Fighter 4.3.1 has an unquoted service path vulnerability in the IMFservice and LiveUpdateSvc services. A local attacker can place a malicious executable in the unquoted path, leading to privilege escalation to LocalSystem upon service restart or system reboot.

Risk Assessment

The organization faces the risk of a local attacker gaining full system control with administrative privileges, potentially executing arbitrary code.

Recommendation

Update IObit Malware Fighter to the latest patched version and ensure all service paths are properly quoted.

Other vulnerabilities in IObit Malware Fighter

CVE-2026-12201Medium
A vulnerability was found in IObit Malware Fighter up to version 13.2.0 related to an unknown functionality of the DLL Handler component. Manipulation of this component causes permission issues. The attack requires local access. An exploit has been published.

Original NVD description (English source)

IObit Malware Fighter 4.3.1 contains an unquoted service path vulnerability in the IMFservice and LiveUpdateSvc services that allows local attackers to escalate privileges. Attackers can insert a malicious executable file in the unquoted service path and trigger privilege escalation when the service restarts or the system reboots, executing code with LocalSystem privileges.