Do not report suspected vulnerabilities in a public issue.

• Email: tixset@gmail.com
• Subject: [SECURITY] ImageWriter vulnerability report

Include the affected version/component, reproduction steps, impact, relevant logs or proof of concept, and a suggested fix if available. Avoid destructive testing on real user data or system disks.

The maintainer aims to acknowledge reports within 48 hours, triage within one week, and prioritize validated critical issues. Timelines are targets rather than contractual guarantees.

ImageWriter performs intentionally destructive raw-disk operations. The GUI confirmation is a usability safeguard, not the privileged authorization boundary.

For ImageWriter Pro:

• the service runs as LocalSystem from the protected Win32 Program Files directory (%ProgramFiles(x86)%\ImageWriter\ImageWriterSvc.exe on 64-bit Windows);
• the service pipe grants full access only to SYSTEM/administrators and read/write access to authenticated medium-integrity users;
• before accepting commands, the service verifies that the connected process is the installed ImageWriterPro.exe in that protected directory;
• the protected installation directory is writable only by SYSTEM and administrators;
• the privileged command handler independently rejects the Windows system disk and disks that Windows cannot identify as removable media or USB;
• invalid security descriptors, disk classification failures, and client-inspection failures are handled fail-closed;
• IPC payloads and read-block allocations have explicit upper bounds;
• compression DLLs load only by absolute path from the protected %ProgramData%\ImageWriter\Libraries\ directory.

The installer also disables the Windows ShellHWDetection service system-wide to suppress AutoPlay format prompts for Linux partitions. This is an intentional availability/usability trade-off rather than a security boundary: Windows AutoPlay remains disabled until an administrator explicitly restores the service.

The short-lived elevated worker also verifies that its pipe client runs from the same executable path.

• Upgrade older service installations by running ImageWriter Pro 2.3.0 installation as administrator.
• Start the Pro GUI from the shortcut created by install.bat after installation.
• Verify downloaded image checksums with an independent trusted tool.
• Back up important data and confirm the physical target, capacity, model, and serial number.
• Use only trusted images and keep Windows and ImageWriter updated.
• Do not rely on the current CLI hash or post-write verification paths; their known correctness issues are listed in CHANGELOG.md.

The dated audit reports under reports/ are historical snapshots. Archive stream ownership was corrected after the 2.3.0 audit. CLI verification/hashing and the malformed DUnit IPC test unit remain unresolved and are not security guarantees.

Validated issues are disclosed after a fix is available and users have had a reasonable opportunity to update. Researchers are credited unless they request anonymity.

Last updated: 20 August 2026