A flaw was identified in IObit Malware Fighter version 13.2.0 and earlier in a component DLL handler whose behaviour is not fully documented. Manipulation of this DLL triggers permission misconfigurations that can be exploited locally to elevate privileges or alter file access. The vulnerability is linked to improper privilege and access control weaknesses (CWE‑266 and CWE‑275). The impact is that a local attacker could gain higher level permissions and potentially execute arbitrary code with those privileges.

The affected product is IObit Malware Fighter up to and including version 13.2.0. Users of this antivirus suite on Windows operating systems are potentially impacted when the vulnerable DLL is present and in use.

The CVSS score of 4.8 places this issue in the moderate range. The EPSS score is not available and it is not listed in the CISA KEV catalog. The attack requires local access, and the exploit code has already been published and may be in use. Consequently, if an attacker gains local control or can persist a malicious DLL on the target system, they could use this vulnerability to increase their privileges and compromise the integrity or availability of the system.