Executive brief
PassMark PerformanceTest, BurnInTest, and OSForensics are benchmarking and diagnostics tools that include a system driver (DirectIo64.sys) to measure hardware performance. An unprivileged local user can exploit an unauthenticated IOCTL handler in this driver to dump all physical memory to a file they control, exposing sensitive data from other users' processes and defeating kernel address space layout randomization (KASLR). The vulnerability also allows writing files to system-protected directories and can crash the kernel on certain system configurations.
Technical details
The vulnerability exists in DirectIo64.sys, a signed kernel-mode driver shipped by PassMark to provide hardware access. An IOCTL handler in the driver lacks caller-identity verification and accepts requests from any unprivileged local user (medium integrity level and above) without authentication. The handler implements a physical memory disclosure feature that writes crash-dump-format (PAGEDU64) images of all physical memory to caller-supplied file paths in the SYSTEM context, bypassing normal Windows access controls. The dump header exposes the kernel module list, active process list, and physical frame number (PFN) database pointers, defeating KASLR. Additionally, the same handler dereferences an unchecked return value from an internal kernel-structure locator without NULL validation, causing kernel crashes when one of three failure paths is triggered. Attack preconditions require either the driver to be loaded as a service without an exclusive handle, or code execution within an elevated PassMark process that holds an open device handle. Patches are available in PerformanceTest 11.1 build 1012 and later, BurnInTest 11.1 build 1000 and later, and OSForensics 11.1 build 1016 and later.
Affected products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Timeline
- 2026-09-04: disclosed: CVE-2026-80118 published
- 2026-08-28: other: Technical analysis published by dkom.dev