Which versions of EaseUS Partition Master are affected by EUVD-2026-38147?

EaseUS Partition Master versions 14.0-14.5 contain a local privilege escalation flaw in the EUEDKEPM.sys kernel driver that allows users with low system privileges to escalate to SYSTEM-level access,…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-38147?

Yes, a public proof-of-concept exploit is available for EUVD-2026-38147. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-38147?

Within 24 hours: Identify and inventory all systems running EaseUS Partition Master 14.0-14.5 in the environment. Within 7 days: Deploy vendor-released patch to update all affected systems to a patched version per EaseUS security advisory. Within 30 days: Complete patch verification across the estate and implement application controls to restrict kernel driver access on high-value systems.

EaseUS Partition Master EUVD-2026-38147

Q: What is the CVSS score of EUVD-2026-38147?

EUVD-2026-38147 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-12782 HIGH

Improper Access Control (CWE-284)

2026-06-21 VulDB

GHSA-2p82-8c67-963q

Authentication Bypass Partition Master Easeus

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local kernel-driver LPE reachable from any authenticated low-priv user (AV:L, PR:L, AC:L, UI:N); successful exploitation yields SYSTEM, giving full C/I/A impact without scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 05:58 vuln.today

CVSS changed

Jun 21, 2026 - 08:22 NVD

8.5 (HIGH) 7.1 (HIGH)

DescriptionCVE.org

A security flaw has been discovered in EaseUS Partition Master up to 14.5. The impacted element is an unknown function in the library EUEDKEPM.sys of the component Kernel Driver. The manipulation results in improper access controls. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The affected component should be upgraded. The vendor explains: "We have confirmed that this issue was present only in older versions of the product. Our product has since been updated, and the issue has been resolved in the latest version, so it no longer exists."

AnalysisAI

Local privilege escalation in EaseUS Partition Master versions 14.0 through 14.5 allows low-privileged users to abuse the EUEDKEPM.sys kernel driver due to improper access controls (CWE-284). Publicly available exploit code exists and the vendor has released a patched version, though the issue is not listed in CISA KEV. The flaw maps to authentication-bypass behavior at the kernel-driver interface, giving attackers a path from a standard user account to SYSTEM-level capabilities.

Technical ContextAI

EUEDKEPM.sys is a Windows kernel-mode driver shipped with EaseUS Partition Master to perform privileged disk and partition operations on behalf of the user-mode application. The vulnerability is classified as CWE-284 (Improper Access Control), meaning the driver exposes IOCTLs or device-object access without adequately restricting which callers (security tokens, integrity levels) may invoke privileged kernel functionality. Affected CPE is cpe:2.3:a:easeus:partition_master:*:*:*:*:*:*:*:* across EUVD-listed versions 14.0-14.5, and the tag 'Authentication Bypass' indicates the driver's access-check logic can be circumvented from a local non-administrative context.

RemediationAI

Patch available per vendor advisory: upgrade EaseUS Partition Master to the latest release from https://www.easeus.com/partition-manager/, which the vendor states resolves the EUEDKEPM.sys access-control issue (an exact fixed version string is not provided in the advisory, so verify the installed driver version after upgrade). Until the upgrade is deployed, compensating controls include uninstalling EaseUS Partition Master from endpoints where it is not required, blocking load of EUEDKEPM.sys via a Microsoft WDAC or AppLocker driver policy (trade-off: the product will stop functioning entirely), and restricting access to the driver's device object by removing local non-admin users from interactive logon on sensitive hosts. Endpoint detection rules should alert on unexpected DeviceIoControl calls to the EaseUS driver from non-EaseUS processes, as that pattern is characteristic of the published exploit.