Loading story…
Newly published CVEs detail unquoted service path vulnerabilities in two IObit products that can let a low-privileged local attacker gain LocalSystem execution. CVE-2016-20055 affects IObit Advanced SystemCare 10.0.2, specifically the AdvancedSystemCareService10 service, while CVE-2016-20059 affects IObit Malware Fighter 4.3.1 through the IMFservice and LiveUpdateSvc services. Both issues are classified as CWE-428 and carry high-severity CVSS v3.1 and v4.0 ratings reflecting potential impact to confidentiality, integrity, and availability.
In both cases, an attacker with local access can place a malicious executable in a vulnerable service path and wait for the affected service to restart or for the system to reboot, at which point the payload may run with elevated privileges. The Malware Fighter entry cites supporting references including IObit product pages, an Exploit-DB listing, and a VulnCheck advisory, while both CVEs were recorded through disclosures submitted to disclosure@vulncheck.com.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
New CVE records were published for CVE-2016-20055 and CVE-2016-20059, documenting CWE-428 unquoted service path vulnerabilities in IObit Advanced SystemCare 10.0.2 and IObit Malware Fighter 4.3.1. The entries describe affected services, note high-severity CVSS v3.1 and v4.0 scores, and reference supporting advisories and exploit material.
On 2026-04-04, disclosure@vulncheck.com received reports for two unquoted service path privilege-escalation vulnerabilities affecting IObit Advanced SystemCare 10.0.2 and IObit Malware Fighter 4.3.1. Both flaws allow a low-privileged local attacker to place a malicious executable in the service path and gain LocalSystem execution when the service restarts or the system reboots.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Newly documented vulnerabilities in **Spy Emergency build 23.0.205** and **sheed AntiVirus 2.3** allow local attackers to escalate privileges to **`LocalSystem`** through **unquoted service path** flaws classified as **`CWE-428`**. The affected services are **`SpyEmrgHealth`** and **`SpyEmrgSrv`** in Spy Emergency, and **`ShavProt`** in sheed AntiVirus. In each case, a low-privileged user can place a malicious executable in a path segment that Windows may incorrectly parse because the service executable path is not enclosed in quotes. If the vulnerable service is restarted or the host is rebooted, Windows can execute the attacker-controlled binary with **SYSTEM-level** privileges, creating a high-impact local privilege escalation path affecting confidentiality, integrity, and availability. The issues are tracked as **`CVE-2016-20056`** for Spy Emergency and **`CVE-2016-20061`** for sheed AntiVirus, with both records referencing vendor resources, **Exploit-DB**, and **VulnCheck** advisories.
Jun 29, 2026
**Small HTTP Server 3.06.36** by Smallsrv contains high-severity Windows service path vulnerabilities tracked as **`CVE-2025-41368`** and **`CVE-2025-41359`**. Both advisories describe an **unquoted service path** affecting the executable configuration `C:\Program Files (x86)\shttps_mg\http.exe service`, which can cause Windows to resolve and launch an attacker-controlled executable from a higher-priority path location instead of the intended service binary. A successful attack requires local access but could lead to **arbitrary code execution**, **unauthorized system access**, or **service disruption** if a malicious file is planted in the path searched by the service. The published mitigations call for properly quoting the Windows service path, applying available security updates, and restricting physical and network access to affected systems.
Jun 29, 2026
Microsoft patched two actively exploited vulnerabilities in Microsoft Defender and related protection components, including **CVE-2026-41091**, a high-severity local privilege escalation flaw that can give an attacker **`NT AUTHORITY\SYSTEM`** privileges, and **CVE-2026-45498**, a medium-severity denial-of-service issue that can make Defender unavailable. The affected products include Microsoft Malware Protection Engine version **1.1.26030.3008 and earlier** and Microsoft Defender Antimalware Platform version **4.18.26030.3011 and earlier**, and both CVEs were added to CISA’s **Known Exploited Vulnerabilities** catalog due to active exploitation in the wild. Technical analysis of **CVE-2026-41091**, dubbed **RedSun**, says the bug lies in Windows Defender’s file remediation workflow when it processes malicious files marked as Cloud Files placeholders. A standard user can abuse Defender’s SYSTEM-level file operations, together with **NTFS junctions** and **oplocks**, to redirect a privileged write into **`C:\Windows\System32`**, plant a malicious binary such as **`TieringEngineService.exe`**, and then trigger execution through Storage Tiers Management COM activation to obtain a SYSTEM shell. Microsoft said the issues were fixed through automatic updates and urged organizations that disable auto-updates to manually update Defender and any products using the same engine and platform components.
Jul 24, 2026