Loading vulnerability…
CVE-2025-26125 is an improper-authorization vulnerability in the IMFForceDelete kernel driver shipped with IObit Malware Fighter v12.1.0. The driver exposes an IOCTL that allows arbitrary user-mode callers to force-delete attacker-specified files using kernel-level capabilities without authentication or authorization checks. An attacker can abuse the driver to remove protected files, including security-product components, and potentially facilitate local privilege escalation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a Windows local privilege escalation exploit targeting the IMFForceDelete driver (part of IObit software). The exploit is implemented in C++ and consists of a Visual Studio project with the main logic in PoC/PoC.cpp. The exploit works by interacting with the vulnerable driver (\\.\IMFForceDelete123) to delete arbitrary files or folders, specifically targeting C:\Config.msi. It then recreates this folder with weak permissions and places crafted RBF and RBS files to abuse the MSI rollback mechanism, ultimately allowing the attacker to execute code as NT AUTHORITY\SYSTEM. The exploit requires local access and the presence of the IMFForceDelete driver. The repository includes resource files and headers to support the exploit, and the README provides background and references to related research. No network endpoints are involved; all actions are performed locally on the Windows filesystem and registry.
3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.