A flaw in the ASC.exe component of IObit Advanced SystemCare allows a local attacker to manipulate the process so that it follows symbolic links. This can lead to unauthorized file access or modification, effectively enabling a privilege escalation or potentially arbitrary code execution, depending on how the symlink is exploited. The vulnerability is described as high‑complexity and difficult to exploit, yet the exploit code has already been released to the public, indicating that capable attackers could attempt the attack.

IObit Advanced SystemCare, version 19, on Windows platforms. The exact product component is the Service module of ASC.exe. No other versions or components are listed as affected; therefore the scope is limited to this specific build of the software.

The CVSS score of 7.3 places this vulnerability in the high‑severity range, but the lack of an EPSS rating and its absence from the CISA KEV catalog suggest that large‑scale exploitation is not currently widespread. Because local privilege is required, the attack vector is limited to users who have a local account with sufficient rights to interact with the ASC.exe process. Overall, the risk is moderate to high for environments where the software is installed with elevated privileges or where local users can influence the application.