Executive brief
Wise Care 365 and Wise Disk Cleaner are popular Windows utility tools used for system optimization and disk cleaning. A security flaw in how these programs start their background services allows a local user with limited permissions to gain full control over the computer. By placing a specially named file in a specific location, an attacker can trick the system into running their malicious code with administrative privileges during the next system reboot.
Technical details
The WiseBootAssistant and SpyHunter 4 Service components in Wise Care 365 (v4.27) and Wise Disk Cleaner (v9.29) utilize unquoted binary paths containing spaces. This CWE-428 vulnerability allows a local attacker with write permissions to the system root or intermediate directories to place a malicious executable (e.g., 'C:\Program.exe') that intercepts the service launch. Because the services run with SYSTEM privileges, the intercepted execution results in full local privilege escalation. The vulnerability is triggered during service startup or system reboot. Users should update to the latest versions of WiseCleaner software where service paths are properly encapsulated in quotation marks.
Affected products
- WiseCleaner Wise Care 365 4.27
- WiseCleaner Wise Disk Cleaner 9.29
Timeline
- 2016-09-23: disclosed: Original exploit published on Exploit-DB
- 2026-06-19: advisory: NVD/VulnCheck advisory published