CVE-2026-12779: AOMEI Dynamic Disk Manager Escalation

CVE-2026-12779 Overview

CVE-2026-12779 is a local privilege escalation vulnerability in AOMEI Dynamic Disk Manager up to version 10.10.1. The flaw resides in the ddmdrv.sys kernel driver and stems from improper access controls [CWE-266] within the driver's handling logic. A local, authenticated attacker can interact with the driver to manipulate kernel-mode operations and gain elevated privileges on the affected Windows host. Public exploit details are available, and the vendor was contacted but did not respond, leaving affected systems without an official patch.

Critical Impact
Local attackers with low privileges can abuse the ddmdrv.sys kernel driver to achieve high-impact compromise of confidentiality, integrity, and availability through improper access controls.

Affected Products

AOMEI Dynamic Disk Manager versions up to and including 10.10.1
Kernel driver component ddmdrv.sys
Windows hosts where the vulnerable driver is installed and loaded

Discovery Timeline

2026-06-21 - CVE-2026-12779 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12779

Vulnerability Analysis

The vulnerability is a local privilege escalation issue in the ddmdrv.sys kernel driver shipped with AOMEI Dynamic Disk Manager. The driver exposes functionality to user-mode callers without enforcing adequate access control checks, mapping to the weakness class CWE-266 (Incorrect Privilege Assignment). Because kernel drivers execute in Ring 0, any improperly gated functionality becomes a direct path from a low-privileged local user to SYSTEM-level control. Public technical writeups categorize the issue as a vulnerable driver primitive that attackers can chain into full host compromise.

Root Cause

The root cause is improper access controls within ddmdrv.sys. The driver does not sufficiently validate the privilege level or context of callers issuing I/O control requests (IOCTLs), allowing operations intended for trusted components to be invoked by ordinary users. This class of flaw frequently exposes raw memory read/write or arbitrary kernel object manipulation, which attackers convert into token replacement or process privilege manipulation.

Attack Vector

Exploitation requires local access with low privileges. An attacker who can execute code on the system opens a handle to the ddmdrv.sys device object and issues crafted IOCTL requests to invoke privileged driver functionality. The attack does not require user interaction and can be triggered by any standard user account with the driver loaded. Refer to the Winslow1984 CVE Collection writeup and the VulDB entry for CVE-2026-12779 for additional technical details.

Detection Methods for CVE-2026-12779

Indicators of Compromise

Presence of the ddmdrv.sys driver loaded on systems where AOMEI Dynamic Disk Manager is not required for business operations
Unexpected user-mode processes opening handles to the ddmdrv device object
Standard-user processes spawning child processes running as SYSTEM shortly after interacting with ddmdrv.sys

Detection Strategies

Inventory endpoints for ddmdrv.sys and correlate driver load events (Windows Event ID 6) with the AOMEI Dynamic Disk Manager installation footprint
Monitor for IOCTL traffic to \\.\ddmdrv device names originating from non-AOMEI processes
Alert on token manipulation or process privilege changes that follow handle opens against the vulnerable driver

Monitoring Recommendations

Enable kernel driver load auditing and forward events to a centralized SIEM for retrospective hunting
Track integrity-level transitions from Medium to System on endpoints with the driver present
Apply the Microsoft Vulnerable Driver Blocklist and monitor for attempts to install or sideload ddmdrv.sys

How to Mitigate CVE-2026-12779

Immediate Actions Required

Uninstall AOMEI Dynamic Disk Manager from systems where it is not actively required
Unload and remove the ddmdrv.sys driver from production endpoints until the vendor releases a fix
Restrict local logon and code execution rights for non-administrative users to limit who can reach the driver interface
Enable Microsoft's Vulnerable Driver Blocklist and Hypervisor-Protected Code Integrity (HVCI) where supported

Patch Information

No vendor patch is available. According to the disclosure, AOMEI was contacted about this vulnerability but did not respond. Until the vendor publishes a fixed release, removal of the affected software is the only reliable remediation. Track the VulDB advisory for CVE-2026-12779 for updates.

Workarounds

Block the ddmdrv.sys driver hash using Windows Defender Application Control (WDAC) or AppLocker policies
Remove the driver service entry and delete the binary from %SystemRoot%\System32\drivers\ if AOMEI Dynamic Disk Manager cannot be uninstalled immediately
Limit administrative tooling for disk management to dedicated, hardened workstations rather than general-purpose endpoints

bash

# Configuration example: query, stop, and remove the vulnerable driver service on Windows
sc.exe query ddmdrv
sc.exe stop ddmdrv
sc.exe delete ddmdrv
del /f %SystemRoot%\System32\drivers\ddmdrv.sys