AOMEI Partition Assistant CVE-2026-12778

Requires (1) AOMEI Partition Assistant 10.10.0 or 10.10.1 installed on the target Windows host so that ampa10.sys is loaded as a kernel driver, and (2) the attacker has already obtained local code execution as an authenticated low-privileged user (PR:L). Limiting factors: cannot be exploited remotely (AV:L), requires the specific vulnerable driver to be present and its device object accessible, and the user must be able to open a handle to the driver - environments without AOMEI installed are not affected, and application-control policies blocking the driver eliminate the exposure.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) yields 7.1 and accurately reflects a local, low-complexity, low-privilege attack producing full confidentiality, integrity, and availability impact - consistent with kernel-mode code execution. Publicly available exploit code is documented at winslow1984.com, raising the practical risk above the raw score, but the vulnerability is not listed in CISA KEV and no EPSS score was provided, suggesting opportunistic rather than mass-scale exploitation. The most significant aggravating factor is that the vendor did not respond to disclosure, so no coordinated patch timeline exists; defenders cannot rely on a forthcoming fix and must treat the driver itself as a liability. This is a real priority for endpoints where AOMEI Partition Assistant is installed, particularly multi-user workstations and any host where initial-access malware could chain this for SYSTEM.

A low-privileged user - or malware that achieved initial code execution as a standard user via phishing or a browser exploit - opens a handle to the ampa10.sys device and issues a crafted IOCTL that the driver executes without proper caller validation, yielding arbitrary kernel read/write or direct SYSTEM token theft. Because public exploit code is already published at winslow1984.com, an attacker can adapt it with minimal effort to elevate from a foothold to full host compromise.