CVE-2016-20059

HIGH

IObit Malware Fighter 4.3.1 Unquoted Service Path Privilege Escalation

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-20059. PoCs published by Amir.ght.

AI-analyzed exploit summary This is a technical writeup detailing an unquoted service path privilege escalation vulnerability in IObit Malware Fighter. The vulnerability allows local attackers to escalate privileges by placing a malicious executable in the service path, which gets executed upon service restart or system reboot.

Description

IObit Malware Fighter 4.3.1 contains an unquoted service path vulnerability in the IMFservice and LiveUpdateSvc services that allows local attackers to escalate privileges. Attackers can insert a malicious executable file in the unquoted service path and trigger privilege escalation when the service restarts or the system reboots, executing code with LocalSystem privileges.

Exploits (1)

exploitdb WRITEUP

by Amir.ght · textlocalwindows

https://www.exploit-db.com/exploits/40525

View Code ZIP pw:eip

This is a technical writeup detailing an unquoted service path privilege escalation vulnerability in IObit Malware Fighter. The vulnerability allows local attackers to escalate privileges by placing a malicious executable in the service path, which gets executed upon service restart or system reboot.

Classification

Writeup 90%

Attack Type

Lpe

Complexity

Trivial

Reliability

Reliable

Target: IObit Malware Fighter 4.3.1

Auth required

Prerequisites: local access to the system · ability to place an executable in the service path

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1548 - Abuse Elevation Control Mechanism

devstral-2 · analyzed Apr 07, 2026 Full analysis →

References (4)

Core 4

Core References

Exploit exploit

ExploitDB-40525

https://www.exploit-db.com/exploits/40525

Product product

Official Product Homepage

http://www.iobit.com/en/index.php

Product product

Product Reference

http://www.iobit.com/downloadcenter.php?product=malware-fighter-free

Third Party Advisory third-party-advisory

VulnCheck Advisory: IObit Malware Fighter 4.3.1 Unquoted Service Path Privilege Escalation

https://www.vulncheck.com/advisories/iobit-malware-fighter-unquoted-service-path-privilege-escalation

Scores

CVSS v3 7.8

EPSS 0.0018

EPSS Percentile 7.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-428

Status published

Products (2)

Iobit/IObit Malware Fighter 4.3.1

iobit/malware_fighter < 4.3.1

Published Apr 04, 2026

Tracked Since Apr 04, 2026