CVE-2026-80116: PassMark DirectIo64.sys privilege escalation

CVE-2026-80116 · Severity: high · CVSS 7.8 · Published 2026-09-04

PassMark's DirectIo64.sys is a hardware access driver shipped with PerformanceTest, BurnInTest, and OSForensics benchmarking tools. The driver is vulnerable to local privilege escalation because it permits unauthenticated access to perform arbitrary PCI device configuration and memory operations. An attacker can modify hardware settings, disable storage controllers, or redirect memory access to cause system instability or data theft.

Technologies: PassMark BurnInTest, PassMark OSForensics, PassMark PerformanceTest. Vendors: PassMark.

Quick answers

Is CVE-2026-80116 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-80116 being exploited in the wild.
How severe is CVE-2026-80116?
High severity, with a CVSS score of 7.8, published 4 September 2026.
Which products and versions are affected?
PassMark BurnInTest before 11.1 build 1000; PassMark OSForensics before 11.1 build 1016; PassMark PerformanceTest before 11.1 build 1012.
Is there a fix for CVE-2026-80116?
A patch was published on 2026: Patches available in PerformanceTest 11.1 build 1012+, BurnInTest 11.1 build 1000+, OSForensics 11.1 build 1016+ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80116 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-80116?
Check whether you run PassMark BurnInTest, PassMark OSForensics or PassMark PerformanceTest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation in DirectIo64.sys (a signed Windows kernel driver) caused by insufficient input validation on IOCTL handlers and an overly permissive device security descriptor. The driver is created with no DACL, defaulting to an ACL that allows any medium-integrity process to open it for read/write access. Attackers can obtain a device handle and issue arbitrary PCI configuration space read/write operations without validation on device selection, register offset, or value. This enables Bus Master DMA enablement on any PCI device, storage controller I/O disruption via command register clearing, or Base Address Register remapping to redirect DMA to attacker-controlled physical addresses. Successful exploitation requires local code execution at medium integrity or above; the device must be openable (either not held exclusively, or exploited from within an elevated PassMark process). Patches are available in PassMark PerformanceTest 11.1 build 1012, BurnInTest 11.1 build 1000, and OSForensics 11.1 build 1016.

Affected products

  • PassMark PerformanceTest before 11.1 build 1012
  • PassMark BurnInTest before 11.1 build 1000
  • PassMark OSForensics before 11.1 build 1016

Timeline

  • 2026-09-04: disclosed: CVE-2026-80116 published; disclosure analysis at dkom.dev on 2026-08-28
  • 2026: patched: Patches available in PerformanceTest 11.1 build 1012+, BurnInTest 11.1 build 1000+, OSForensics 11.1 build 1016+

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.