CVE-2025-0223
📋 TL;DR
This vulnerability in IObit Protected Folder allows local attackers to cause a denial of service (system crash) through a null pointer dereference in the IURegistryFilter.sys driver. Attackers need local access to the system to exploit this flaw. Users of IObit Protected Folder up to version 13.6.0.5 are affected.
💻 Affected Systems
- IObit Protected Folder
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
System crash (blue screen/BSOD) leading to denial of service and potential data loss if unsaved work exists.
Likely Case
Local denial of service causing system instability or crash, requiring reboot.
If Mitigated
Minimal impact if proper access controls prevent local attackers from reaching vulnerable component.
🎯 Exploit Status
Exploit code has been publicly disclosed. Requires local access and ability to send IOCTL to the vulnerable driver.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Check for updates in IObit Protected Folder settings. 2. If no update available, consider uninstalling until vendor releases patch. 3. Monitor IObit website for security updates.
🔧 Temporary Workarounds
Disable or uninstall IObit Protected Folder
windowsRemove the vulnerable software to eliminate the attack surface
Control Panel > Programs > Uninstall a program > Select IObit Protected Folder > Uninstall
Restrict access to vulnerable driver
windowsUse application control or security policies to block access to IURegistryFilter.sys
🧯 If You Can't Patch
- Implement strict local access controls and privilege separation
- Monitor for crash dumps or system instability events related to IURegistryFilter.sys
🔍 How to Verify
Check if Vulnerable:
Check IObit Protected Folder version in program settings or Control Panel > ProgramsCheck Version:
wmic product where name="IObit Protected Folder" get versionVerify Fix Applied:
Verify installed version is newer than 13.6.0.5 or software is removed📡 Detection & Monitoring
Log Indicators:
- System crash logs (Event ID 41)
- Driver failure events related to IURegistryFilter.sys
- Unexpected system reboots
Network Indicators:
- None - local vulnerability only
SIEM Query:
EventID=41 OR Source="System" AND EventID=1001 AND "IURegistryFilter"