CVE-2026-80112: PassMark DirectIo64 improper access control in kernel driver

CVE-2026-80112 · Severity: high · CVSS 7.8 · Published 2026-09-04

PassMark's DirectIo64.sys is a signed kernel driver used by PerformanceTest, BurnInTest, and OSForensics to provide hardware access for benchmarking and diagnostics. The driver creates a device object without proper security restrictions, allowing any unprivileged user to perform privileged hardware operations—such as reading CPU temperatures, accessing memory, and probing the PCI bus—that should be restricted to administrators. An attacker can exploit this to gain unauthorized access to sensitive hardware information or perform low-level system manipulation.

Technologies: PassMark BurnInTest, PassMark OSForensics, PassMark PerformanceTest. Vendors: PassMark.

Quick answers

Is CVE-2026-80112 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-80112 being exploited in the wild.
How severe is CVE-2026-80112?
High severity, with a CVSS score of 7.8, published 4 September 2026.
Which products and versions are affected?
PassMark BurnInTest before 11.1 build 1000; PassMark OSForensics before 11.1 build 1016; PassMark PerformanceTest before 11.1 build 1012.
Is there a fix for CVE-2026-80112?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-80112 attacked?
It is attacked with local access.
Am I affected by CVE-2026-80112?
Check whether you run PassMark BurnInTest, PassMark OSForensics or PassMark PerformanceTest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper access control flaw in the DirectIo64.sys kernel driver. The driver creates a device object using IoCreateDevice without specifying a security descriptor, causing Windows to apply a permissive default DACL that grants FILE_GENERIC_READ, FILE_GENERIC_WRITE, and FILE_GENERIC_EXECUTE permissions to all users (Everyone group). An unprivileged local attacker with medium integrity level or above can open a handle to the device and issue IOCTLs to access restricted hardware operations without any privilege or integrity checks. The vulnerability is present in PassMark PerformanceTest before build 1012, BurnInTest before build 1000, and OSForensics before build 1016; remediation requires using IoCreateDeviceSecure with a proper security descriptor. A partial mitigation (exclusive handle holding) was implemented at build b1005 but does not prevent exploitation when the driver is loaded as a service or when code executes within the product's elevated process.

Affected products

  • PassMark PerformanceTest before 11.1 build 1012
  • PassMark BurnInTest before 11.1 build 1000
  • PassMark OSForensics before 11.1 build 1016

Timeline

  • 2026-08-28: disclosed: Technical analysis published at dkom.dev
  • 2026-09-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.