Which versions of AOMEI Dynamic Disk Manager are affected by CVE-2026-12779?

AOMEI Dynamic Disk Manager versions through 10.10.1 contain an unpatched local privilege escalation flaw that allows any user on affected systems to gain SYSTEM-level access; with publicly available…

Is there a public PoC exploit available for CVE-2026-12779?

Yes, a public proof-of-concept exploit is available for CVE-2026-12779. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12779?

Within 24 hours: Identify all systems running AOMEI Dynamic Disk Manager versions up to 10.10.1 and assess operational dependency. Within 7 days: Begin testing replacement disk management solutions and verify business requirements. Within 30 days: Complete migration to vendor-supported alternatives or confirm AOMEI has released security updates.

AOMEI Dynamic Disk Manager CVE-2026-12779

Q: What is the CVSS score of CVE-2026-12779?

CVE-2026-12779 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-38144 HIGH

Improper Access Control (CWE-284)

2026-06-21 VulDB

GHSA-xmv6-8rvm-ww7w

Authentication Bypass Dynamic Disk Manager Aomei

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local-only kernel driver IOCTL abuse from any standard user account (AV:L, PR:L, AC:L, UI:N) yields full SYSTEM compromise, giving high C/I/A within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 05:56 vuln.today

CVSS changed

Jun 21, 2026 - 06:22 NVD

8.5 (HIGH) 7.1 (HIGH)

DescriptionCVE.org

A vulnerability was found in AOMEI Dynamic Disk Manager up to 10.10.1. This issue affects some unknown processing in the library ddmdrv.sys of the component Kernel Driver. Performing a manipulation results in improper access controls. The attack must be initiated from a local position. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Local privilege escalation in AOMEI Dynamic Disk Manager up to version 10.10.1 stems from improper access controls in the ddmdrv.sys kernel driver, allowing a low-privileged local user to interact with privileged driver IOCTLs and gain SYSTEM-level control. Publicly available exploit code exists, and the vendor did not respond to coordinated disclosure, leaving installations unpatched. No CISA KEV listing or active exploitation has been confirmed at time of analysis.

Technical ContextAI

AOMEI Dynamic Disk Manager is a Windows disk and partition management utility that installs the ddmdrv.sys kernel-mode driver to perform privileged volume operations. The root cause is CWE-284 (Improper Access Control): the driver exposes device objects or IOCTL handlers without adequately validating the caller's security context, so unprivileged user-mode processes can issue requests that the driver services with kernel privileges. Per the CPE (cpe:2.3:a:aomei:dynamic_disk_manager), the flaw is in the application's bundled signed kernel driver rather than in Windows itself, making any host with the product installed a viable target - and a signed-but-vulnerable driver is also a candidate for BYOVD abuse on hosts where it is dropped intentionally.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor was contacted but did not respond, so no upgrade target exists. As compensating controls, uninstall AOMEI Dynamic Disk Manager from any host where it is not actively required (eliminates the vulnerable driver entirely, at the cost of losing the disk management tooling); where the product must remain installed, block-list or remove ddmdrv.sys via Microsoft's Vulnerable Driver Blocklist / WDAC policies, accepting that the application's disk operations will fail when the driver is absent. Restrict interactive and remote logon to the affected hosts to trusted administrators only to reduce the pool of users who could trigger the local exploit, and monitor EDR for unexpected loads of ddmdrv.sys (particularly BYOVD scenarios on machines that never installed the product). Track https://vuldb.com/vuln/372520 and https://nvd.nist.gov/vuln/detail/CVE-2026-12779 for any future vendor advisory.