Which versions of EaseUS Partition Master are affected by CVE-2026-12781?

Organizations deploying EaseUS Partition Master through version 14.5 expose themselves to privilege escalation risks that bypass security controls entirely.. A patch is available.

Is there a public PoC exploit available for CVE-2026-12781?

Yes, a public proof-of-concept exploit is available for CVE-2026-12781. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12781?

Within 24 hours: Identify systems running EaseUS Partition Master 14.5 and earlier through your asset inventory. Within 7 days: Obtain the latest EaseUS Partition Master version from the vendor and verify it addresses CVE-2026-12781, then deploy across all affected systems. Within 30 days: Confirm deployment completion and restrict Partition Master execution to authorized personnel via application control policies.

EaseUS Partition Master CVE-2026-12781

Q: What is the CVSS score of CVE-2026-12781?

CVE-2026-12781 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-38146 HIGH

Improper Access Control (CWE-284)

2026-06-21 VulDB

GHSA-5497-893c-j3pf

Authentication Bypass Partition Master Easeus

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local attacker with low-privileged authenticated access exploits a kernel driver lacking access checks to gain SYSTEM, yielding full CIA impact with no UI and no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 05:57 vuln.today

CVSS changed

Jun 21, 2026 - 08:22 NVD

8.5 (HIGH) 7.1 (HIGH)

DescriptionCVE.org

A vulnerability was identified in EaseUS Partition Master up to 14.5. The affected element is an unknown function in the library epmntdrv.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed locally. The exploit is publicly available and might be used. You should upgrade the affected component. The vendor explains: "We have confirmed that this issue was present only in older versions of the product. Our product has since been updated, and the issue has been resolved in the latest version, so it no longer exists."

AnalysisAI

Local privilege escalation in EaseUS Partition Master through version 14.5 stems from improper access controls in the epmntdrv.sys kernel driver, allowing a low-privileged local user to gain SYSTEM-level control over the host. Publicly available exploit code exists and the vendor has confirmed the issue was resolved in newer releases, though no specific patched version is named in the advisory.

Technical ContextAI

epmntdrv.sys is a Windows kernel-mode driver bundled with EaseUS Partition Master to mediate low-level disk and partition operations that user-mode tooling cannot perform directly. The flaw is classified as CWE-284 (Improper Access Control), meaning the driver exposes IOCTL handlers or device objects without adequately restricting which callers may invoke privileged operations - a recurring weakness in OEM disk-management drivers where the device security descriptor permits Everyone/Authenticated Users to open the handle. Once a low-privileged process can talk to the driver, it can leverage the driver's kernel-mode capabilities (arbitrary read/write of physical memory, raw disk access, or partition table manipulation) to escalate to SYSTEM. The affected CPE is cpe:2.3:a:easeus:partition_master:*:*:*:*:*:*:*:*, and the EUVD enumerates versions 14.0 through 14.5 as vulnerable.

RemediationAI

Patch available per vendor advisory - EaseUS states the issue is resolved in the latest version of Partition Master, so upgrade to the current release from https://www.easeus.com/partition-manager/ and confirm the shipped epmntdrv.sys is the post-fix build; an exact patched version number is not published in the advisory, so verify with EaseUS support before declaring systems clean. Where immediate upgrade is not possible, compensating controls include uninstalling Partition Master from systems that do not require it (eliminating the attack surface entirely), blocking or removing the epmntdrv.sys driver via WDAC or Microsoft's vulnerable-driver blocklist (side effect: Partition Master will fail to perform privileged disk operations until re-enabled), and tightening the device object's DACL via a wrapper or restricting non-admin local logons on affected hosts (side effect: may break legitimate non-admin usage of the tool). Detection-side, monitor for unexpected CreateFile opens of \\.\EPMNTDRV or similar device names from non-administrator processes.