Executive brief
AOMEI Backupper, a popular backup and recovery software, contains a vulnerability in its kernel driver that allows standard users to bypass Windows security restrictions. By using a specific interface provided by the software, a local attacker can read or modify protected system files and data directly on the hard drive. This could lead to the theft of sensitive information or allow an attacker to gain full administrative control over the computer.
Technical details
AOMEI Backupper (up to version 8.3.0) installs a signed kernel driver, amwrtdrv.sys, which exposes a user-reachable raw disk forwarding interface at \\.\amwrtdrv\Partition0\DISK<N>. This interface fails to enforce proper Access Control Lists (ACLs), allowing a standard, non-administrative user to perform raw read and write operations directly to disk sectors. By bypassing Windows' standard file system protections and PhysicalDrive access restrictions, a local attacker can read sensitive administrator-only files or overwrite system data to achieve local privilege escalation (LPE). As of the advisory date, the vendor has not responded to disclosure attempts, and no official patch is available; remediation involves manually restricting the driver device object ACLs.
Affected products
- AOMEI Backupper Up to 8.3.0
Timeline
- 2026-06-21: advisory: NVD and VulDB publication date
- 2026-06-21: disclosed: Public disclosure of exploit details and proof of concept