CVE-2026-12784: IM-Magic Partition Resizer Privilege Escalation

CVE-2026-12784 Overview

CVE-2026-12784 is a local privilege escalation vulnerability in IM-Magic Partition Resizer versions up to 7.9.0. The flaw resides in the MDA_NTDRV.sys kernel driver and stems from improper access controls [CWE-266] on an unspecified function exposed by the driver. A local, authenticated attacker can interact with the driver to perform privileged operations that should be restricted. Public exploit information has been released, increasing the risk of opportunistic abuse on systems where the driver is loaded. The vendor was contacted ahead of public disclosure but did not respond.

Critical Impact
Local attackers can abuse the MDA_NTDRV.sys kernel driver to escalate privileges and compromise confidentiality, integrity, and availability of the affected host.

Affected Products

IM-Magic Partition Resizer up to and including version 7.9.0
Component: Kernel Driver MDA_NTDRV.sys
Platform: Windows hosts where the vulnerable driver is installed or loaded

Discovery Timeline

2026-06-21 - CVE-2026-12784 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12784

Vulnerability Analysis

The vulnerability sits in the MDA_NTDRV.sys kernel driver shipped with IM-Magic Partition Resizer. The driver exposes functionality to user-mode callers without enforcing adequate access controls. Because the driver runs in kernel context, any user-mode caller with sufficient handle access can trigger privileged operations and break the user/kernel security boundary.

The weakness is classified under [CWE-266] Incorrect Privilege Assignment. The attack is local and requires low privileges with no user interaction. Public exploit material has been referenced by third-party sources, lowering the barrier for reuse by attackers who can already execute code on a target machine.

Root Cause

The root cause is missing or insufficient privilege enforcement on a function exposed by MDA_NTDRV.sys. The driver does not restrict which callers may invoke sensitive IOCTL or device handler routines, allowing standard users to perform actions that should be reserved for SYSTEM or administrators.

Attack Vector

Exploitation requires local access and a low-privileged account on a Windows host where the driver is loaded. An attacker opens a handle to the device object exposed by MDA_NTDRV.sys and issues crafted requests to the unprotected function. The resulting kernel-mode operation grants the attacker elevated capabilities, which can be chained with other techniques to achieve full host compromise.

No verified proof-of-concept code is reproduced here. Refer to the VulDB entry for CVE-2026-12784 and the Winslow CVE collection writeup for technical references.

Detection Methods for CVE-2026-12784

Indicators of Compromise

Presence of MDA_NTDRV.sys in C:\Windows\System32\drivers\ or vendor install directories on systems that do not require IM-Magic Partition Resizer
Service or driver registration entries referencing MDA_NTDRV under HKLM\SYSTEM\CurrentControlSet\Services
Handle opens to the MDA_NTDRV device object by non-administrative processes
Unexpected child processes spawned with SYSTEM integrity following execution of unsigned user binaries

Detection Strategies

Inventory endpoints for the MDA_NTDRV.sys driver hash and version, regardless of whether the Partition Resizer GUI is installed
Alert on driver load events (Windows Event ID 7045 and Sysmon Event ID 6) where the image path matches MDA_NTDRV.sys
Monitor DeviceIoControl calls from low-integrity processes targeting the IM-Magic device object
Correlate token elevation events with prior interaction with the vulnerable driver to identify in-progress privilege escalation

Monitoring Recommendations

Enable kernel driver load auditing and forward logs to a centralized SIEM for retention and correlation
Use Microsoft Vulnerable Driver Blocklist policies to track driver provenance and block known-bad kernel modules
Track creation of new services that point to vendor utility drivers outside the standard installation workflow

How to Mitigate CVE-2026-12784

Immediate Actions Required

Identify and uninstall IM-Magic Partition Resizer 7.9.0 and earlier from production endpoints until a fixed release is available
Remove or block loading of MDA_NTDRV.sys using Windows Defender Application Control or the Microsoft Vulnerable Driver Blocklist
Restrict local logon and limit standard user execution privileges on hosts that must retain the software
Audit for prior abuse by reviewing privileged process creation events tied to non-administrative users

Patch Information

No vendor patch is currently referenced in the public advisory. The vendor was contacted before disclosure but did not respond. Monitor the IM-Magic vendor site and the VulDB entry for updates on a fixed release.

Workarounds

Disable the MDA_NTDRV service by setting its Start value to 4 (disabled) when the partition tool is not actively in use
Apply Windows Defender Application Control policies that block the driver by hash or signer
Restrict membership in local administrator groups so that the driver cannot be reinstalled by non-privileged users

bash

# Disable the vulnerable driver service on Windows (run as administrator)
sc.exe config MDA_NTDRV start= disabled
sc.exe stop MDA_NTDRV

# Optional: remove the driver file once the service is stopped
del "%SystemRoot%\System32\drivers\MDA_NTDRV.sys"