Null Pointer Dereference Vulnerability in IObit Advanced SystemCare Ultimate
CVE-2024-12658

5.5MEDIUM

Key Information:

Vendor

IObit

Status
Advanced Systemcare Ultimate
Vendor
CVE Published:
16 December 2024

What is CVE-2024-12658?

The vulnerability identified as CVE-2024-12658 pertains to IObit Advanced SystemCare Ultimate, specifically in version 17.0.0 and earlier. This critical issue is associated with the AscRegistryFilter.sys library's IOCTL handler, function 0x8001E01C, resulting in a null pointer dereference. This flaw requires local access for exploitation and has been publicly disclosed. As the vendor has not responded to disclosures regarding this vulnerability, users are urged to exercise caution and stay updated on mitigations.

References

https://shareforall.notion.site/IOBit-Advanced-SystemCare...
https://vuldb.com/?ctiid.288527
https://vuldb.com/?id.288527

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.