CVE-2016-20059

CVE-2016-20059 describes an unquoted service path vulnerability (CWE-428) in IObit Malware Fighter 4.3.1's IMFservice and LiveUpdateSvc, enabling local privilege escalation. This high-severity flaw (CVSS 7.8) allows an attacker to place a malicious executable in the unquoted path, gaining LocalSystem privileges when the service restarts or system reboots. The attack vector is local with low complexity, requiring no user interaction. There is no evidence of active exploitation, nor are public exploit modules available in common frameworks. Community discussion is minimal, with only one mention, suggesting low current attention to this older vulnerability.