CVE-2026-12784 Details

A local privilege escalation vulnerability has been identified in IM-Magic Partition Resizer Free Portable versions through 7.9.0. The issue resides in the kernel driver MDA_NTDRV.sys, which improperly manages access controls. This vulnerability allows standard local users to bypass Windows file access control lists (ACLs) and manipulate protected file data at the raw disk level. The exploitation involves reading and writing to files that are restricted to administrative access, using the vulnerable driver to circumvent normal security measures.

Users are advised not to expose raw disk forwarding devices to unprivileged users. Instead, create device objects that only allow access to administrators or trusted services, and validate caller identities and access rights before forwarding raw disk operations. Additionally, known vulnerable driver hashes should be added to blocklists until a fix is available.