CVE-2026-12780 Details

A local privilege escalation vulnerability has been identified in AOMEI Backupper versions prior to 8.3.0. The issue resides in the kernel driver amwrtdrv.sys, which improperly manages access controls. This vulnerability allows standard users to exploit raw disk read and write capabilities, bypassing Windows access restrictions. The vulnerability has been publicly disclosed, and the vendor has not responded to initial contact regarding the issue.

To address this vulnerability, the driver should be updated to restrict access to the raw disk forwarding interface, ensuring that standard users cannot exploit the functionality. Additionally, implementing an administrative privilege check before allowing read or write operations to disk devices could help prevent unauthorized access.