High severity · published Jan 26, 2026
CVE-2020-36952
IObit Uninstaller 10 Pro - Unquoted Service Path
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
IObit Uninstaller 10 Pro contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted service path in the IObit Uninstaller Service to insert malicious code that would execute with SYSTEM-level permissions during service startup.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IU
IObit Uninstaller · Iobit
10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-36952
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-36952
www.exploit-db.com
https://www.exploit-db.com/exploits/49371
www.iobit.com
https://www.iobit.com
www.vulncheck.com
https://www.vulncheck.com/advisories/iobit-uninstaller-pro-unquoted-service-path
More from IObit Uninstaller
7.8
CVE-2020-37223
IObit Uninstaller 9.5.0.15 Unquoted Service Path Privilege Escalation