CVE-2026-15475: MiniTool Partition Wizard Escalation

CVE-2026-15475 Overview

CVE-2026-15475 is an improper access control weakness in the pwdrvio.sys signed kernel driver shipped with MiniTool Partition Wizard versions up to 13.6. The flaw resides in an unspecified function within the Signed Kernel Driver component. A local, low-privileged attacker can interact with the driver to bypass access restrictions enforced at the kernel boundary. The weakness is classified under [CWE-266: Incorrect Privilege Assignment]. According to the vendor advisory, upgrading to MiniTool Partition Wizard version 13.9 remediates the issue. The vendor was notified prior to public disclosure, and a public exploit reference has been documented in third-party CVE collections.

Critical Impact
Local attackers with low privileges can abuse the signed pwdrvio.sys driver to interact with kernel-mode functionality that should be restricted, enabling potential privilege escalation on affected Windows hosts.

Affected Products

MiniTool Partition Wizard versions up to and including 13.6
MiniTool Partition Wizard kernel driver pwdrvio.sys (Signed Kernel Driver component)
Windows systems where the vulnerable driver is installed or loaded

Discovery Timeline

2026-07-12 - CVE-2026-15475 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15475

Vulnerability Analysis

The vulnerability affects pwdrvio.sys, a signed kernel-mode driver bundled with MiniTool Partition Wizard. Because the driver is digitally signed, Windows loads it into kernel space with high trust. An unspecified function within the driver enforces insufficient access controls on requests originating from user mode. As a result, a local attacker running with limited privileges can send crafted requests to the driver and access functionality that should be restricted to privileged callers. The issue falls under the [CWE-266] category, which covers incorrect privilege assignment where an actor is granted permissions beyond intended scope.

Root Cause

The root cause is missing or insufficient caller-privilege validation inside a routine exposed by the pwdrvio.sys driver. Kernel drivers that expose device interfaces must verify the security context of user-mode callers before performing privileged operations. In this driver, that verification is either absent or incomplete, so requests from standard users reach code paths intended for administrators or the operating system.

Attack Vector

Exploitation requires local access to a system where the vulnerable driver is loaded. An attacker opens a handle to the driver's device object and issues I/O control requests to reach the affected function. Because the driver is signed, it can also be brought onto systems that do not have MiniTool Partition Wizard installed by adversaries employing a Bring Your Own Vulnerable Driver (BYOVD) technique. Public exploit information has been referenced through the VulDB entry for this CVE, but no verified proof-of-concept code is included in the enriched dataset, so exploitation details are described in prose rather than reproduced here.

Detection Methods for CVE-2026-15475

Indicators of Compromise

Presence of pwdrvio.sys on hosts where MiniTool Partition Wizard is not an approved application, which may indicate BYOVD staging.
Loading of pwdrvio.sys by processes other than the legitimate MiniTool Partition Wizard installer or executable.
Creation of a service or kernel driver registration that points to pwdrvio.sys outside the standard installation directory.

Detection Strategies

Inventory endpoints for the file hash and version of pwdrvio.sys and flag versions associated with MiniTool Partition Wizard 13.6 or earlier.
Monitor Windows event logs for driver load events (Event ID 6, 7045) referencing pwdrvio.sys.
Hunt for user-mode processes opening handles to the driver's device object followed by DeviceIoControl calls that lead to privilege changes or new SYSTEM-context processes.

Monitoring Recommendations

Enable and forward Microsoft-Windows-Sysmon Event ID 6 (driver loaded) to a central log platform for correlation.
Track process lineage where a non-administrative process interacts with pwdrvio.sys and subsequently spawns a child running as SYSTEM.
Add pwdrvio.sys versions up to 13.6 to the Microsoft vulnerable driver blocklist tracking workflow and audit any exceptions.

How to Mitigate CVE-2026-15475

Immediate Actions Required

Upgrade MiniTool Partition Wizard to version 13.9 or later on every host where the product is installed.
Remove pwdrvio.sys from systems that do not require MiniTool Partition Wizard functionality.
Enable the Microsoft Vulnerable Driver Blocklist and Hypervisor-Protected Code Integrity (HVCI) to prevent loading of known-vulnerable signed drivers.

Patch Information

MiniTool has addressed the vulnerability in MiniTool Partition Wizard version 13.9. Refer to the MiniTool Partition Manager Upgrade History for the release notes and to the VulDB advisory for CVE-2026-15475 for disclosure context. Additional technical notes are available in the Winslow 1984 CVE Collection entry.

Workarounds

Restrict local login rights and remove unnecessary local accounts on hosts where the driver cannot be immediately upgraded.
Add pwdrvio.sys file hashes for vulnerable versions to Windows Defender Application Control (WDAC) or AppLocker deny rules to block execution.
Uninstall MiniTool Partition Wizard where the disk-management functionality is not required for business operations.

bash

# Configuration example: query and remove a vulnerable pwdrvio.sys service on Windows
sc.exe query pwdrvio
sc.exe stop pwdrvio
sc.exe delete pwdrvio
# Then remove the driver file from %SystemRoot%\System32\drivers\pwdrvio.sys