Executive brief
AOMEI Partition Assistant, a popular disk management utility, contains a vulnerability in its kernel driver that allows standard users to bypass Windows security protections. By interacting with this driver, an unprivileged user can gain direct read and write access to the computer's physical hard drives, which is normally restricted to administrators. This could allow an attacker to steal sensitive data, modify system files, or take full control of the operating system.
Technical details
The AOMEI Partition Assistant kernel driver, ampa10.sys, exposes a device object (e.g., \\.\wowrt) with an insecure security descriptor that allows access to standard local users. The driver acts as a proxy, forwarding file read and write requests directly to the underlying disk stack. Because these requests originate from kernel mode, they bypass the standard Windows access checks that normally prevent non-administrative users from opening physical disk devices like \\.\PhysicalDriveN. An attacker with local access can use this primitive to perform arbitrary raw disk I/O, enabling them to modify boot records, system hives, or sensitive binaries to achieve local privilege escalation (LPE). As of the advisory date, the vendor has not responded to the disclosure.
Affected products
- AOMEI Partition Assistant Standard up to 10.10.1
Timeline
- 2026-06-21: disclosed: Vulnerability details and proof-of-concept disclosed to the public.
- 2026-06-21: advisory