EUVD-2026-43197
GHSA-fx54-g6r7-6jq2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack requiring a low-privilege account to reach the driver; no scope change as kernel impact is contained within the vulnerable system per available data.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element is an unknown function in the library pwdrvio.sys of the component Signed Kernel Driver. This manipulation causes improper access controls. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 13.9 is sufficient to fix this issue. The affected component should be upgraded. The vendor was contacted early about this disclosure.
AnalysisAI
Improper access controls in MiniTool Partition Wizard's signed kernel driver pwdrvio.sys (versions up to 13.6) allow a local low-privileged user to interact with privileged driver functionality without authorization. The vulnerability is tagged as an authentication bypass against a kernel-mode component, meaning a standard user account can invoke driver operations that should be restricted to administrative or system-level callers. A publicly available proof-of-concept exploit lowers the practical exploitation bar, though no active exploitation is confirmed via CISA KEV at time of analysis.
Technical ContextAI
MiniTool Partition Wizard installs a signed Windows kernel driver, pwdrvio.sys, to perform low-level disk and partition operations that require elevated privilege. Kernel drivers communicate with user-mode applications via IOCTL (I/O Control) codes dispatched through the Windows I/O manager. CWE-284 (Improper Access Control) in this context typically manifests as the driver failing to enforce a security descriptor or omitting ACL checks on its device object, allowing any local process - regardless of privilege - to open a handle to the driver and issue privileged IOCTLs. The affected CPE is cpe:2.3:a:minitool:partition_wizard:*:*:*:*:*:*:*:* covering all versions through 13.6. Because the driver is signed, it loads without triggering Kernel Patch Protection (PatchGuard) warnings, increasing its attractiveness as a privilege escalation vector.
RemediationAI
Upgrade MiniTool Partition Wizard to version 13.9 or later, which the vendor confirms resolves this issue. The upgrade history and download are available at https://www.minitool.com/partition-manager/upgrade-history.html. If immediate upgrade is not possible, a compensating control is to restrict which users can load or interact with the pwdrvio.sys driver by tightening the device object's ACL via Group Policy or a third-party kernel driver management tool - though this is operationally complex and may break Partition Wizard functionality. Alternatively, organizations can uninstall MiniTool Partition Wizard entirely from endpoints where it is not operationally required, eliminating the attack surface. Neither workaround should be treated as a permanent substitute for patching to 13.9.
More in Partition Wizard
View allMiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to escalate privileges to the s
MiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to achieve remote code execut
MiniTool Partition Wizard 12.8 contains an insecure installation mechanism that allows attackers to achieve remote code
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today