Which versions of IM-Magic Partition Resizer are affected by CVE-2026-12784?

IM-Magic Partition Resizer versions 7.0-7.9.0 contain an unpatched local privilege escalation vulnerability affecting organizations running this disk management utility on endpoints.

Is there a public PoC exploit available for CVE-2026-12784?

Yes, a public proof-of-concept exploit is available for CVE-2026-12784. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12784?

Within 24 hours: Conduct an inventory scan to identify all systems running IM-Magic Partition Resizer versions 7.0-7.9.0. Within 7 days: Evaluate and procure alternatives (e.g., Windows Disk Management, AOMEI Partition Assistant, Macrorit Partition Expert with active security support), then begin staged uninstall of IM-Magic Partition Resizer. Within 30 days: Complete removal from all endpoints; if removal is not operationally feasible for specific systems, apply OS-level compensating controls and document the business justification.

IM-Magic Partition Resizer CVE-2026-12784

Q: What is the CVSS score of CVE-2026-12784?

CVE-2026-12784 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-38149 HIGH

Improper Access Control (CWE-284)

2026-06-21 VulDB

GHSA-fw2h-288w-q47j

Authentication Bypass Partition Resizer

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local low-privileged user sends IOCTL to a kernel driver with broken access control, gaining full SYSTEM-level C/I/A; no user interaction, no scope change to a separate security authority.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 05:59 vuln.today

CVSS changed

Jun 21, 2026 - 08:22 NVD

8.5 (HIGH) 7.1 (HIGH)

DescriptionCVE.org

A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0. This affects an unknown function in the library MDA_NTDRV.sys of the component Kernel Driver. This manipulation causes improper access controls. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Local privilege escalation in IM-Magic Partition Resizer up to 7.9.0 stems from improper access controls in the MDA_NTDRV.sys kernel driver, allowing a low-privileged local user to gain elevated kernel-level capabilities. Publicly available exploit code exists and the vendor did not respond to coordinated disclosure, leaving all currently shipped versions (7.0 through 7.9.0) without a fix. No public exploit identified as being used in attacks (not in CISA KEV), but POC weaponization risk is elevated given the unpatched status.

Technical ContextAI

MDA_NTDRV.sys is the signed Windows kernel-mode driver bundled with IM-Magic Partition Resizer, a free partition management utility that requires kernel-mode access to manipulate disk volumes, MBR/GPT structures, and filesystem metadata. The root cause is CWE-284 (Improper Access Control): the driver exposes IOCTL handlers or device objects without adequately restricting which user-mode callers may invoke privileged operations, a common pattern in third-party storage drivers where the DACL on the device object permits non-administrative access or where IOCTL dispatch routines fail to validate the caller's token. The affected CPE cpe:2.3:a:im-magic:partition_resizer covers the application, but the vulnerable component is the bundled signed driver, which also creates a 'Bring Your Own Vulnerable Driver' (BYOVD) risk even on systems where Partition Resizer is not installed.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor was contacted but did not respond. Primary mitigation is to uninstall IM-Magic Partition Resizer from all endpoints and, critically, verify that MDA_NTDRV.sys is removed from %SystemRoot%\System32\drivers since uninstallers frequently leave signed drivers behind, preserving BYOVD exploitability. As a compensating control, add MDA_NTDRV.sys to the Microsoft Vulnerable Driver Blocklist (enabled via Windows Security > Core Isolation > Microsoft Vulnerable Driver Blocklist, or via WDAC policy) - side effect is that legitimate use of Partition Resizer will cease to function, which is acceptable given no fix exists. Where the tool is operationally required, restrict installation to dedicated administrative workstations isolated from general user accounts, since the flaw requires only a local low-privileged session to exploit. Monitor for the public POC referenced at https://winslow1984.com/books/cve-collection/page/im-magic-partition-resizer-790-kernel-driver-mda-ntdrvsys-local-privilege-escalation as a detection signature source.