# CVE-2026-80114: PassMark DirectIo64.sys hardcoded credentials and privilege escalation

Source: https://junglewise.ai/threats/cve-2026-80114-passmark-directio64-sys-hardcoded-credentials-and-privilege  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-80114 · Severity: high · CVSS 7.8 · Published 2026-09-04

PassMark PerformanceTest, BurnInTest, and OSForensics include a signed hardware-access driver with hardcoded credentials embedded in its binary. An attacker with local access can extract this key and forge authentication tags to perform arbitrary physical memory writes, potentially compromising system security and enabling privilege escalation. The driver also contains a secondary bypass that allows attackers to disable additional validation checks entirely.

Technologies: [PassMark BurnInTest](https://junglewise.ai/threats/technologies/burnintest), [PassMark OSForensics](https://junglewise.ai/threats/technologies/osforensics), [PassMark PerformanceTest](https://junglewise.ai/threats/technologies/performancetest). Vendors: [PassMark](https://junglewise.ai/threats/vendors/passmark).

## Quick answers

**Is CVE-2026-80114 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80114 being exploited in the wild.

**How severe is CVE-2026-80114?** High severity, with a CVSS score of 7.8, published 4 September 2026.

**Which products and versions are affected?** PassMark BurnInTest before 11.1 build 1000; PassMark OSForensics before 11.1 build 1016; PassMark PerformanceTest before 11.1 build 1012.

**Is there a fix for CVE-2026-80114?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-80114 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-80114?** Check whether you run PassMark BurnInTest, PassMark OSForensics or PassMark PerformanceTest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability resides in DirectIo64.sys, a signed kernel driver shipped with PassMark's benchmarking and forensics tools. The driver implements MAC-based authentication using an 8-byte key hardcoded as a literal in the distributed binary; attackers can extract this key and compute valid MD5 authentication tags for arbitrary IOCTL write requests that perform physical memory operations. A secondary bypass exists via a bit-clear IOCTL that modifies a gating instruction's displacement byte, causing all subsequent write requests to skip MAC verification, size checks, and Vendor ID checks entirely. The device is created without a restrictive security descriptor (IoCreateDevice rather than IoCreateDeviceSecure), allowing any medium-integrity process to open it. The attack requires local access and the ability to open the device; while PassMark applications hold an exclusive handle during normal use, the underlying ACL permits unprivileged access when the driver is loaded as a service or from within an elevated process. Patches are available in PerformanceTest 11.1 build 1012 and later.

## Affected products

- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016

## Timeline

- 2026-09-04: disclosed: CVE-2026-80114 published
- 2026-08-28: other: Technical analysis published on dkom.dev

## References

- [https://dkom.dev/posts/directio64-disclosure/](https://dkom.dev/posts/directio64-disclosure/)
- [https://github.com/floppywiggler/directio64-disclosure](https://github.com/floppywiggler/directio64-disclosure)

## Related threats

- [PassMark DirectIo64.sys physical memory disclosure via IOCTL](https://junglewise.ai/threats/cve-2026-80119-passmark-directio64-sys-physical-memory-disclosure-via-ioctl)
- [PassMark PerformanceTest, BurnInTest, OSForensics physical memory disclosure in DirectIo64.sys](https://junglewise.ai/threats/cve-2026-80118-passmark-performancetest-burnintest-osforensics-physical-memory)
- [PassMark DirectIo64.sys privilege escalation via unvalidated I/O port access](https://junglewise.ai/threats/cve-2026-80117-passmark-directio64-sys-privilege-escalation-via-unvalidated-i-o)
- [PassMark DirectIo64.sys privilege escalation](https://junglewise.ai/threats/cve-2026-80116-passmark-directio64-sys-privilege-escalation)
- [PassMark DirectIo64 privilege escalation and denial of service via insufficient IOCTL validation](https://junglewise.ai/threats/cve-2026-80115-passmark-directio64-privilege-escalation-and-denial-of-service)