AOMEI Dynamic Disk Manager CVE-2026-12779

Attacker must already have local code execution as a low-privileged user (PR:L) on a Windows host where the AOMEI ddmdrv.sys kernel driver is loaded - either because AOMEI Dynamic Disk Manager 10.10.0 or 10.10.1 is installed, or because the attacker has dropped and loaded the signed driver themselves (BYOVD). No user interaction (UI:N) and no additional attack requirements (AT:N) are needed, and the exploitable IOCTL interface is reachable from a standard user session without administrative rights. Limiting factors: the attack vector is local only (AV:L) - there is no network-reachable path - and exploitation requires the vulnerable driver to be present and loaded on the target system, which is not the Windows default.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and base score of 7.1 accurately reflect a local, low-complexity, low-privilege attack delivering high confidentiality, integrity, and availability impact - i.e., full SYSTEM compromise from any interactive user account. Publicly available exploit code (E:P in the vector and a referenced write-up at winslow1984.com) materially raises real-world risk because the path from initial foothold to SYSTEM is essentially turnkey. Mitigating factors: exploitation is local-only (no remote vector) and the affected product is a niche admin tool rather than ubiquitous infrastructure, so blast radius is bounded to hosts that have installed it. The vendor's non-response is the dominant risk driver: with no patch and a public PoC, this becomes a durable post-exploitation primitive for any attacker who has commodity user-level access, and the signed driver creates BYOVD exposure even on systems that never installed the product. No EPSS score was provided in the input, and the CVE is not on CISA KEV, so widespread opportunistic exploitation is not currently evidenced.

An attacker who has obtained low-privilege code execution on a Windows host - for example via a phishing payload running as a standard user - opens a handle to the ddmdrv.sys device object and issues the IOCTL sequence demonstrated in the public PoC on winslow1984.com to perform privileged operations from kernel context. The result is escalation to NT AUTHORITY\SYSTEM, after which the attacker disables defenses, harvests credentials, and moves laterally. Because the driver is signed, the same primitive is usable as BYOVD on hosts that never installed AOMEI by dropping ddmdrv.sys and loading it.