Executive brief
A vulnerability in AOMEI disk management software allows a standard computer user to bypass Windows security restrictions and gain direct access to the computer's physical hard drive. Typically, only administrators can perform raw disk operations; however, this flaw allows an unprivileged user to read or write sensitive data directly to the disk. This could lead to a complete takeover of the system, data theft, or the corruption of critical operating system files.
Technical details
A local privilege escalation vulnerability exists in the AOMEI kernel driver 'ddmdrv.sys' (shipped with Dynamic Disk Manager and Partition Assistant Standard). The driver exposes the '\\.\ddmwrt' device object with an insecure security descriptor, allowing standard (non-admin) users to open handles to it. The driver then forwards raw I/O requests (IRP_MJ_READ/WRITE) directly to the underlying disk stack. Because these requests originate from a kernel-mode driver, they bypass the standard Windows access checks that normally restrict '\\.\PhysicalDriveN' access to administrators. An attacker can use this to perform raw sector reads/writes, allowing them to tamper with the file system, modify registry hives, or overwrite privileged system files to achieve full SYSTEM privileges. Additionally, the driver incorrectly reports the number of bytes processed in I/O requests.
Affected products
- AOMEI Dynamic Disk Manager up to 10.10.1
- AOMEI Partition Assistant Standard 10.10.1
Timeline
- 2026-06-21: disclosed: Vulnerability disclosed via VulDB and NVD
- 2026-06-21: advisory