# CVE-2026-80117: PassMark DirectIo64.sys privilege escalation via unvalidated I/O port access

Source: https://junglewise.ai/threats/cve-2026-80117-passmark-directio64-sys-privilege-escalation-via-unvalidated-i-o  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-80117 · Severity: high · CVSS 7.1 · Published 2026-09-04

PassMark's DirectIo64.sys kernel driver, used in PerformanceTest, BurnInTest, and OSForensics to access hardware performance metrics, contains a privilege escalation flaw. A standard user can exploit this to execute arbitrary I/O port commands (IN/OUT instructions) to any x86 port, including those controlling system reset, CMOS settings, and interrupt controllers, enabling immediate system resets or other low-level hardware manipulation without administrator privileges.

Technologies: [PassMark BurnInTest](https://junglewise.ai/threats/technologies/burnintest), [PassMark OSForensics](https://junglewise.ai/threats/technologies/osforensics), [PassMark PerformanceTest](https://junglewise.ai/threats/technologies/performancetest). Vendors: [PassMark](https://junglewise.ai/threats/vendors/passmark).

## Quick answers

**Is CVE-2026-80117 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80117 being exploited in the wild.

**How severe is CVE-2026-80117?** High severity, with a CVSS score of 7.1, published 4 September 2026.

**Which products and versions are affected?** PassMark BurnInTest before 11.1 build 1000; PassMark OSForensics before 11.1 build 1016; PassMark PerformanceTest before 11.1 build 1012.

**Is there a fix for CVE-2026-80117?** A patch was published on 2026-09-04: Patches available in PerformanceTest 11.1 build 1012, BurnInTest 11.1 build 1000, and OSForensics 11.1 build 1016 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80117 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-80117?** Check whether you run PassMark BurnInTest, PassMark OSForensics or PassMark PerformanceTest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a privilege escalation in the DirectIo64.sys kernel driver due to missing port validation and allowlisting on exposed IOCTLs. The driver creates a device object with a permissive default DACL (FILE_GENERIC_READ | FILE_GENERIC_WRITE | FILE_GENERIC_EXECUTE for Everyone) and no token or integrity checks on callers. An unprivileged local user (medium integrity) can open the device and submit arbitrary I/O port commands; the dispatcher validates neither the port address nor the instruction type. Attack preconditions include local code execution and the device being openable (either the driver running as a service without an exclusive handle, or code executing in the elevated application process). The fix involves enforcing an allowlist of safe ports and restricting device access via a stricter security descriptor (IoCreateDeviceSecure). Patches are available in PerformanceTest 11.1 build 1012+, BurnInTest 11.1 build 1000+, and OSForensics 11.1 build 1016+.

## Affected products

- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016

## Timeline

- 2026-08-28: disclosed: Technical disclosure published at dkom.dev
- 2026-09-04: advisory: NVD published CVE-2026-80117
- 2026-09-04: patched: Patches available in PerformanceTest 11.1 build 1012, BurnInTest 11.1 build 1000, and OSForensics 11.1 build 1016

## References

- [https://dkom.dev/posts/directio64-disclosure/](https://dkom.dev/posts/directio64-disclosure/)
- [https://github.com/floppywiggler/directio64-disclosure](https://github.com/floppywiggler/directio64-disclosure)

## Related threats

- [PassMark DirectIo64.sys physical memory disclosure via IOCTL](https://junglewise.ai/threats/cve-2026-80119-passmark-directio64-sys-physical-memory-disclosure-via-ioctl)
- [PassMark PerformanceTest, BurnInTest, OSForensics physical memory disclosure in DirectIo64.sys](https://junglewise.ai/threats/cve-2026-80118-passmark-performancetest-burnintest-osforensics-physical-memory)
- [PassMark DirectIo64.sys privilege escalation](https://junglewise.ai/threats/cve-2026-80116-passmark-directio64-sys-privilege-escalation)
- [PassMark DirectIo64 privilege escalation and denial of service via insufficient IOCTL validation](https://junglewise.ai/threats/cve-2026-80115-passmark-directio64-privilege-escalation-and-denial-of-service)
- [PassMark DirectIo64.sys hardcoded credentials and privilege escalation](https://junglewise.ai/threats/cve-2026-80114-passmark-directio64-sys-hardcoded-credentials-and-privilege)