CVE-2026-12779: AOMEI Dynamic Disk Manager Privilege Escalation in ddmdrv.sys

Technical summary

CVE-2026-12779 is a privilege escalation flaw affecting the ddmdrv.sys kernel driver component in AOMEI Dynamic Disk Manager up to version 10.10.1. The vulnerability stems from improper access control enforcement (CWE-266, CWE-284) in unspecified processing logic within the driver. An attacker with local user privileges can manipulate the driver interface to circumvent security checks and execute kernel-mode operations with elevated privileges. The attack requires local code execution capability but no user interaction. The CVSS 3.1 score of 7.8 (HIGH) reflects the potential for complete system compromise—confidentiality, integrity, and availability are all at risk.

Business impact

This vulnerability presents a critical privilege escalation path for attackers who have already gained initial user-level access to a machine running AOMEI Dynamic Disk Manager. In scenarios where an attacker compromises a standard user account (via phishing, software supply chain compromise, or other means), this kernel driver flaw enables lateral escalation to SYSTEM privileges, effectively granting complete control over the affected machine. Organizations using AOMEI Dynamic Disk Manager for storage management should assess the risk of user compromise within their environment and evaluate the business impact of full system takeover on machines running the affected software.

Affected systems

AOMEI Dynamic Disk Manager versions up to and including 10.10.1 are affected. Machines running this software on Windows are at risk if a local, authenticated user account exists and the kernel driver is loaded. The vulnerability requires local access, so air-gapped or highly restricted machines face lower risk. Organizations should inventory systems running Dynamic Disk Manager and prioritize those with general user access or elevated user populations.

Exploitability

This vulnerability has a low exploitation barrier. Public exploit code exists, which significantly increases the likelihood of active exploitation. The attack vector is local, meaning the attacker must already have a foothold on the target machine, but the privilege requirement is only user-level—a standard, unprivileged account. No user interaction is required once code execution is achieved. The combination of public exploit availability and straightforward exploitation mechanics makes this a practical risk for any system with an unprivileged attacker present.

Remediation

Verify and deploy the latest patched version of AOMEI Dynamic Disk Manager from the vendor. Given the vendor's lack of response to early disclosure, monitor the AOMEI website and update channels for security advisories. Until a patch is available, organizations should consider restricting driver loading to trusted administrative contexts or disabling the software if not essential. For systems where the software is mission-critical, apply network segmentation and strong access controls to limit the spread of user-level compromises.

Patch guidance

Check the official AOMEI Dynamic Disk Manager update mechanism (Help > Check for Updates or the vendor website) for versions beyond 10.10.1. Apply patches promptly once available. Until official guidance is released by AOMEI, maintain current version documentation and test any updates in a non-production environment first. If AOMEI does not release a timely patch, evaluate alternative disk management software or enforce driver signing and loading restrictions at the operating system level.

Detection guidance

Monitor for abnormal interactions with ddmdrv.sys, particularly from user-mode processes attempting to open the driver handle or send unusual control codes. Kernel driver loading and unloading events can be logged via Windows Event Tracing (ETW) or third-party endpoint detection tools. Watch for privilege escalation events following AOMEI Dynamic Disk Manager operations (process creation with elevated tokens from lower-privilege parent processes). Network-based detection is limited since the attack is entirely local; focus on endpoint monitoring, driver access logs, and behavioral indicators of privilege escalation.

Why prioritize this

This vulnerability should be prioritized due to the convergence of multiple risk factors: a publicly available exploit, privilege escalation to SYSTEM level, and vendor non-responsiveness limiting the certainty of a timely patch. Any organization using AOMEI Dynamic Disk Manager should treat this as an urgent patching or mitigation task. The HIGH CVSS score (7.8) combined with exploitability ensures that systems running the affected software are practical targets for post-exploitation privilege escalation attacks.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a HIGH severity vulnerability with significant real-world impact. The Local Attack Vector (AV:L) and Low Attack Complexity (AC:L) indicate minimal barriers to exploitation once an attacker gains user-level code execution. Low Privilege Requirement (PR:L) means a standard user account suffices. No User Interaction (UI:N) and Unchanged Scope (S:U) simplify the attack further. The impact metrics (C:H, I:H, A:H) confirm that successful exploitation grants complete control over confidentiality, integrity, and availability—effectively full system compromise. Public exploit availability and vendor non-responsiveness elevate the real-world risk beyond the base CVSS calculation.

Frequently asked questions