Is CVE-2026-12201 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12201 being exploited in the wild.

How severe is CVE-2026-12201?

Medium severity, with a CVSS score of 5.3, published 15 June 2026.

Which products and versions are affected?

IObit Malware Fighter up to 13.2.0.

Is there a fix for CVE-2026-12201?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12201 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-12201?

Check whether you run IObit Malware Fighter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12201: IObit Malware Fighter privilege escalation in DLL Handler

CVE-2026-12201 · Severity: medium · CVSS 5.3 · Published 2026-06-15

A security flaw in IObit Malware Fighter, a popular antivirus and anti-malware tool, allows an attacker with local access to the computer to gain elevated permissions. By exploiting how the software handles certain system files, an attacker can delete arbitrary files or execute unauthorized code with high-level system privileges. This could lead to a complete takeover of the affected computer or the disabling of security protections.

Vendors: IObit.

Quick answers

Is CVE-2026-12201 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12201 being exploited in the wild.
How severe is CVE-2026-12201?: Medium severity, with a CVSS score of 5.3, published 15 June 2026.
Which products and versions are affected?: IObit Malware Fighter up to 13.2.0.
Is there a fix for CVE-2026-12201?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12201 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-12201?: Check whether you run IObit Malware Fighter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A local privilege escalation vulnerability exists in IObit Malware Fighter up to version 13.2.0 due to incorrect privilege assignment (CWE-266) and insecure DLL handling. The flaw involves a 'DLL Handler' component that can be manipulated by a local user with low privileges to delete arbitrary files or perform DLL sideloading. Specifically, an attacker can replace or spoof 'ProductNews2.dll' in the application directory or search path to execute code with high integrity. This vulnerability represents a bypass of a previous patch attempt by the vendor. As of the advisory date, the vendor has not released a fix, and functional exploit code is publicly available.

Affected products

IObit Malware Fighter up to 13.2.0

Timeline

2026-03-11: other: Exploit code published on GitHub
2026-06-15: disclosed: Vulnerability disclosed and CVE assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.