Junglewise Threat Intelligence

CVE-2026-15475: MiniTool Partition Wizard privilege escalation in pwdrvio.sys driver

CVE-2026-15475 · Severity: medium · CVSS 5.3 · Published 2026-07-12

Executive brief

MiniTool Partition Wizard, a popular disk management utility, contains a vulnerability in its signed kernel driver. A local user with standard permissions can bypass Windows security controls to read or modify protected system files and raw disk data. This could allow an attacker to gain administrative privileges or access sensitive information on the machine.

Technical details

A local privilege escalation vulnerability exists in MiniTool Partition Wizard (up to version 13.6) within the signed kernel driver 'pwdrvio.sys'. The driver exposes a device object (\\.\PartitionWizardDiskAccesser) that fails to properly restrict access to low-privileged users. An attacker can send specific IOCTL requests to this device to perform raw disk reads and writes, bypassing NTFS file system permissions and Windows access control lists. This allows a standard user to read or overwrite sensitive system files or filesystem metadata. The issue is resolved in version 13.9.

Affected products

  • MiniTool Partition Wizard Up to 13.6

Timeline

  • 2026-07-07: patched: Version 13.9 released
  • 2026-07-12: disclosed: Public disclosure of CVE-2026-15475

References