Improper Access Control in MiniTool Partition Wizard Signed Kernel Driver

Executive Summary

CVE-2026-15475 is a local privilege escalation vulnerability in MiniTool Partition Wizard up to version 13.6. It exists in the signed kernel driver component pwdrvio.sys, which exposes a device interface allowing unprivileged users to perform raw disk read and write operations from kernel context.

This driver forwards disk IOCTL requests without enforcing normal Windows access controls, enabling an attacker with standard user privileges to bypass access restrictions. As a result, the attacker can read sensitive file contents and modify protected files by writing directly to their underlying NTFS data clusters.

The vulnerability can only be exploited locally, and a proof-of-concept tool exists demonstrating how to read and write disk sectors through the vulnerable driver.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of the vulnerable signed kernel driver pwdrvio.sys used by MiniTool Partition Wizard up to version 13.6.

Since the vulnerability involves an exposed device interface named \\.\PartitionWizardDiskAccesser\<disk_number> that allows raw disk read/write operations, detection can include verifying if this device interface exists and if unprivileged users have access to it.

Commands to help detect the vulnerability could include:

• Using PowerShell or Command Prompt to check for the driver file: `dir C:\Windows\System32\drivers\pwdrvio.sys`
• Using Device Manager or `sc query pwdrvio` to check if the driver service is running.
• Using Sysinternals tools like `handle.exe` or `Process Explorer` to check if the device interface \\.\PartitionWizardDiskAccesser\ exists and which processes have handles to it.
• Attempting to open the device interface from a standard user context to see if raw disk IOCTLs can be sent, which would indicate the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unprivileged local user to bypass Windows file and disk access controls, potentially leading to unauthorized reading and modification of protected files.

• An attacker could read sensitive file contents that should be protected.
• An attacker could modify or corrupt protected files by writing directly to their disk clusters.
• This could lead to data integrity issues, unauthorized data disclosure, or system instability.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-15475 allows a local unprivileged user to bypass normal Windows access controls and read or modify protected files by exploiting a vulnerability in the signed kernel driver pwdrvio.sys of MiniTool Partition Wizard. This improper access control can lead to unauthorized disclosure and modification of sensitive data stored on the affected system.

Such unauthorized access and potential data manipulation could negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls to protect sensitive personal and health information from unauthorized access or alteration.

Organizations using affected versions of MiniTool Partition Wizard may face increased risk of data breaches or integrity violations if this vulnerability is exploited, thereby potentially violating regulatory requirements for data confidentiality, integrity, and security.

Upgrading to version 13.9, which fixes this issue, is necessary to mitigate this risk and maintain compliance with such standards.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade MiniTool Partition Wizard to version 13.9 or later, as this version fixes the vulnerability.

Additional immediate steps include:

• Restrict access to the device object \Device\PartitionWizardDiskAccesser to trusted users and components only.
• Implement or enforce caller impersonation in the driver to ensure proper access checks are performed before forwarding disk IOCTL requests.
• Remove or strictly control generic disk IOCTL forwarding in the driver to prevent unprivileged raw disk access.
• Limit local user privileges to reduce the risk of exploitation since the attack requires local access.

Useful 0 Not Useful 0