CVE-2026-12193: VS Revo RevoUninstaller IOCTL RevoDetector.sys IOCtl_Handler heap-based overflow

Synopsis

A heap-based buffer overflow exists in RevoDetector.sys, the kernel driver component of VS Revo RevoUninstaller versions 2.5.x and 2.6.x. The vulnerability is reached locally by a low-privileged user who sends a crafted IOCTL request to the IOCtl_Handler function, triggering the overflow in kernel memory. Successful exploitation gives the attacker full read and write access to the system and can crash the affected service; a patched-image rebuild at version 2.7.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to send the crafted IOCTL request; no administrative credentials are needed.

• Victim interactionNot required

  No user interaction or social engineering is required; the attacker triggers the overflow directly.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special memory layout required.

Blast Radius

• Reads sensitive data from kernel and process memory, including credentials or session material accessible to the kernel driver.
• Writes to kernel memory, allowing an attacker to modify security-relevant data structures or escalate local privileges.
• Crashes the RevoDetector.sys driver, disrupting uninstaller functionality and potentially destabilizing the host.
• A public proof-of-concept exploit exists, lowering the bar for exploitation in any environment where the driver is loaded.