An incorrect permissions assignment vulnerability exists in the amwrtdrv.sys kernel driver of AOMEI Backupper 8.4.0. This flaw allows an unprivileged local user to write arbitrarily to the physical disk. When Secure Boot is disabled, this can be exploited to execute malicious UEFI-level code before the operating system loads. Such an attack bypasses OS security controls like HVCI, EDR, and Windows Defender. Additionally, it may allow capture of BitLocker Volume Master Key material. The driver creates a world-accessible device object, enabling unrestricted write requests from any user-mode process. Attackers can modify disk sectors to inject a malicious UEFI payload. This payload executes during the UEFI Boot Device Selection phase, before OS security is active. A successful exploit allows UEFI code injection, bypassing all kernel-mode security. On systems with TPM-only BitLocker, this enables pre-boot VMK credential capture. AOMEI has released patches to address this vulnerability. Users should update to a corrected version or uninstall the software. Disabling the amwrtdrv.sys service is a temporary mitigation. Enabling Secure Boot offers defense in depth but does not fix the root cause.