CVE-2026-12784: IM-Magic Partition Resizer Kernel Driver Privilege Escalation

Technical summary

The vulnerability stems from improper access control mechanisms in the MDA_NTDRV.sys kernel driver component. Classified under CWE-266 (Incorrect Privilege Assignment) and CWE-284 (Improper Access Control), it allows a local, low-privileged user to manipulate driver functionality without proper authorization. The attack vector is local with low complexity and no user interaction required. An attacker leveraging this flaw can achieve read, write, and execute access outside their intended permission scope, potentially leading to full system compromise.

Business impact

Organizations relying on IM-Magic Partition Resizer face risk of privilege escalation and data integrity compromise. A local attacker—such as a disgruntled employee or compromised account holder—could escalate to administrative access, modify disk partitions, encrypt or destroy data, or install persistent malware. The combination of public exploits and vendor non-responsiveness means mitigation cannot wait for an official patch, forcing immediate operational decisions.

Affected systems

IM-Magic Partition Resizer through version 7.9.0 is affected. The flaw resides in the kernel driver component, making it a system-level risk affecting all instances where the software is installed with driver privileges enabled. Any Windows system running a vulnerable version is at risk if a local user account exists that could be compromised or leveraged by an insider.

Exploitability

This vulnerability is exploitable with local access and low privilege; no special conditions or user interaction are required. Critically, public exploit code is now available, reducing the barrier to weaponization. Attackers need only system access—via a low-privilege account, remote shell, or persistence mechanism from a prior compromise—to trigger the flaw. The lack of complexity and availability of working exploits position this as a practical, high-impact attack vector.

Remediation

Immediate steps include identifying and inventorying all systems running IM-Magic Partition Resizer up to version 7.9.0. Evaluate whether the partition resizing functionality is necessary; if not, uninstall the software entirely. If continued use is required, verify with the vendor whether version 7.10.0 or later addresses this flaw, or contact IM-Magic support directly for an emergency patch. Restrict local system access through privilege management and monitoring. Consider disabling or sandboxing the driver where operationally feasible.

Patch guidance

Check the vendor's official advisory and product updates page for patched versions beyond 7.9.0. Verify the patch version against IM-Magic's security bulletins before deployment. If no patch is forthcoming after reasonable time, plan for migration to an alternative disk management solution. Test any patch in a non-production environment first, as kernel driver updates can impact system stability. Monitor vendor communications for updates, given the current lack of response.

Detection guidance

Monitor for unexpected kernel driver load/unload events involving MDA_NTDRV.sys. Use endpoint detection and response (EDR) tools to flag privilege escalation attempts originating from processes interacting with the driver. Enable Windows Audit Policy logging for privilege use and object access. Check process creation logs for unusual child processes spawned by applications using the driver. Forensic analysis should focus on driver parameter tampering and unauthorized system calls that bypass normal access control checks.

Why prioritize this

This vulnerability merits urgent prioritization due to: (1) CVSS 7.8 (HIGH) severity with full confidentiality, integrity, and availability impact; (2) public availability of working exploits; (3) local privilege escalation potential on affected systems; (4) vendor non-responsiveness limiting remediation options; and (5) kernel-level access implications. Any system running this software in an environment with multiple local user accounts or where lateral movement from compromised accounts is possible should be remediated within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects high severity: local attack vector, low complexity, low privilege requirements, no user interaction needed, and severe impact across confidentiality, integrity, and availability. The score does not fully capture the added risk from publicly available exploits and vendor non-responsiveness, both of which increase real-world exploitability and reduce effective time-to-remediation. Organizations should treat this as a critical asset if partition management is central to their operations.

Frequently asked questions