MiniTool pwdrvio.sys Kernel Write-What-Where — Local Privilege Escalation Primitive (CVE-2026-36981)

Metadata

Affected Target

Summary

MiniTool’s pwdrvio.sys kernel driver exposes a write-what-where condition through its IOCTL interface, allowing an unprivileged local attacker to write attacker-controlled data to an attacker-controlled kernel address. The included PoC demonstrates a debugger-assisted arbitrary kernel-write primitive that can be leveraged toward full privilege escalation. Coordinated disclosure ran from vendor notification in February 2026 through public disclosure in May 2026.

Vulnerability Details

Root Cause

The pwdrvio.sys IOCTL handler accepts both a destination kernel address and data to write from the calling (unprivileged) process without validating that the address is safe to write to.

Attack Vector

1. As a local, unprivileged user, open a handle to the pwdrvio.sys device.
2. Send a crafted IOCTL request specifying an attacker-chosen kernel address and attacker-controlled data.
3. The driver writes the data to the specified kernel address, providing a write-what-where primitive usable to escalate privileges (e.g. by overwriting a token or credential structure).

Impact

Local unprivileged user can obtain an arbitrary kernel-write primitive, enabling privilege escalation to SYSTEM.

Environment / Lab Setup

Target:   Windows system with the vulnerable MiniTool pwdrvio.sys driver loaded
Attacker: C compiler, a kernel debugger (for the demonstrated PoC), local unprivileged Windows account

Proof of Concept

PoC Script

See LPE_PoC.c in this folder.

1

Compile and run LPE_PoC.c on a system with a kernel debugger attached (per the source README's demonstrated methodology)

Uses the pwdrvio.sys IOCTL interface to perform a debugger-assisted arbitrary kernel write, demonstrating the underlying write-what-where primitive that can be leveraged toward privilege escalation.

Detection & Indicators of Compromise

Signs of compromise:

• Unprivileged processes sending IOCTLs to pwdrvio.sys
• Unexplained privilege escalation events on systems with MiniTool software installed

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/canomer/CVE-2026-36981-Kernel-EoP-PoC on 2026-07-05.