CVE-2026-12778 Overview
CVE-2026-12778 is a local privilege escalation vulnerability in AOMEI Partition Assistant versions up to 10.10.1. The flaw resides in the ampa10.sys kernel driver and stems from improper access controls [CWE-266]. A local, low-privileged attacker can interact with the driver to gain elevated privileges on affected Windows systems. The exploit has been publicly disclosed, and the vendor did not respond to early disclosure attempts. Because the vulnerable component is a signed kernel driver, the issue can also be abused in Bring Your Own Vulnerable Driver (BYOVD) scenarios.
Critical Impact
Local attackers with low privileges can leverage the ampa10.sys driver to achieve kernel-level code execution, compromising confidentiality, integrity, and availability of the host.
Affected Products
- AOMEI Partition Assistant versions up to and including 10.10.1
- Kernel driver component ampa10.sys
- Windows hosts where the driver is installed and loaded
Discovery Timeline
- 2026-06-21 - CVE-2026-12778 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-12778
Vulnerability Analysis
The vulnerability resides in ampa10.sys, a kernel-mode driver shipped with AOMEI Partition Assistant. The driver exposes functionality to user-mode callers without enforcing adequate access controls, classified under [CWE-266] Incorrect Privilege Assignment. A local attacker authenticated with low privileges can open a handle to the driver and issue IOCTL requests that should be restricted to privileged contexts.
Because kernel drivers execute in ring 0, successful abuse provides full control over the operating system. The flaw is exploitable only from a local context, but no user interaction is required beyond initial code execution. The public disclosure increases the likelihood of weaponization in commodity privilege escalation toolkits.
Root Cause
The root cause is insufficient privilege checks on the device object or IOCTL handlers exposed by ampa10.sys. The driver permits unprivileged user-mode processes to invoke operations that interact with kernel memory or perform privileged disk and partition operations. Without proper Access Control List (ACL) enforcement on the device object or caller validation inside dispatch routines, any local user can reach sensitive kernel functionality.
Attack Vector
An attacker first obtains code execution on the target system as a standard user. The attacker opens a handle to the \\.\ampa10 device and issues crafted DeviceIoControl calls to the vulnerable driver. The handler processes the request without validating the caller's privilege level, granting arbitrary kernel read, write, or execution primitives. The attacker then escalates to SYSTEM by manipulating process tokens or kernel structures.
Detailed technical analysis is available in the Winslow Blog CVE Collection and the VulDB CVE-2026-12778 entry.
Detection Methods for CVE-2026-12778
Indicators of Compromise
- Presence of ampa10.sys loaded on systems where AOMEI Partition Assistant is not actively used or authorized
- Unexpected CreateFile calls targeting the \\.\ampa10 device object from non-AOMEI processes
- Standard user processes opening handles to the AOMEI driver followed by token manipulation or SYSTEM-context process creation
Detection Strategies
- Monitor for driver load events (Windows Event ID 6, Sysmon Event ID 6) referencing ampa10.sys on hosts without an authorized AOMEI deployment
- Hunt for process lineage where a non-elevated process opens the AOMEI device handle and is followed by privilege escalation indicators
- Flag execution of ampa10.sys outside the legitimate installation path as a potential BYOVD attempt
Monitoring Recommendations
- Enable Microsoft's Vulnerable Driver Blocklist and ensure ampa10.sys versions up to 10.10.1 are denied where feasible
- Collect kernel driver load telemetry centrally and alert on previously unseen signed driver loads on endpoints
- Correlate suspicious DeviceIoControl activity with subsequent token impersonation or LSASS access events
How to Mitigate CVE-2026-12778
Immediate Actions Required
- Inventory all endpoints for the presence of AOMEI Partition Assistant version 10.10.1 or earlier and the ampa10.sys driver
- Uninstall AOMEI Partition Assistant from systems where it is not operationally required
- Add ampa10.sys to the Windows Driver Blocklist or Application Control policy to prevent loading
Patch Information
No vendor patch is currently documented. The vendor was contacted prior to public disclosure but did not respond, according to the VulDB advisory. Organizations should monitor AOMEI release notes for an updated build superseding version 10.10.1 and apply it immediately when available.
Workarounds
- Remove or block the ampa10.sys driver via Windows Defender Application Control (WDAC) or AppLocker policies
- Restrict local logon and limit which users can execute arbitrary binaries on systems retaining the driver
- Apply the Microsoft recommended driver blocklist and keep it updated to cover vulnerable signed drivers
# Example WDAC deny rule fragment for blocking ampa10.sys by file hash
# Generate the hash and policy with New-CIPolicy / New-CIPolicyRule on a reference system
New-CIPolicyRule -DriverFilePath "C:\Windows\System32\drivers\ampa10.sys" -Level FileHash -Deny
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
