CVE-2026-80113: PassMark DirectIo64 privilege escalation via IOCTL handler

CVE-2026-80113 · Severity: high · CVSS 7.1 · Published 2026-09-04

PassMark's DirectIo64 driver is a hardware-access component shipped with PerformanceTest, BurnInTest, and OSForensics that allows these applications to access low-level system information like memory timings and temperature sensors. The driver fails to validate physical memory addresses passed through certain system calls, allowing an unprivileged local user to modify arbitrary system memory locations and escalate privileges or compromise the entire system.

Technologies: PassMark BurnInTest, PassMark OSForensics, PassMark PerformanceTest. Vendors: PassMark.

Quick answers

Is CVE-2026-80113 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-80113 being exploited in the wild.
How severe is CVE-2026-80113?
High severity, with a CVSS score of 7.1, published 4 September 2026.
Which products and versions are affected?
PassMark BurnInTest before 11.1 build 1000; PassMark OSForensics before 11.1 build 1016; PassMark PerformanceTest before 11.1 build 1012.
Is there a fix for CVE-2026-80113?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-80113 attacked?
It is attacked with local access.
Am I affected by CVE-2026-80113?
Check whether you run PassMark BurnInTest, PassMark OSForensics or PassMark PerformanceTest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a privilege escalation vulnerability in DirectIo64.sys, a signed kernel driver shipped with PassMark products. The vulnerability stems from missing validation of the physical address parameter in an exposed IOCTL handler—when a user opens a device handle to the driver, they can invoke the handler with an arbitrary 64-bit physical address and bit index. The driver then calls MmMapIoSpace and clears bits at that address without validating whether it points to kernel code pages or page table entries. No authentication or integrity-level checks gate access to the IOCTL dispatcher; the driver uses a permissive default security descriptor that allows any medium-integrity process to open it for read and write. An attacker can supply carefully crafted physical addresses to corrupt kernel code or page tables, achieving local privilege escalation. Patches are available: PerformanceTest 11.1 build 1012+, BurnInTest 11.1 build 1000+, OSForensics 11.1 build 1016+.

Affected products

  • PassMark PerformanceTest before 11.1 build 1012
  • PassMark BurnInTest before 11.1 build 1000
  • PassMark OSForensics before 11.1 build 1016

Timeline

  • 2026-08-28: disclosed: Technical analysis published at dkom.dev
  • 2026-09-04: advisory: CVE-2026-80113 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.