# CVE-2026-80118: PassMark PerformanceTest, BurnInTest, OSForensics physical memory disclosure in DirectIo64.sys

Source: https://junglewise.ai/threats/cve-2026-80118-passmark-performancetest-burnintest-osforensics-physical-memory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-80118 · Severity: high · CVSS 7.1 · Published 2026-09-04

PassMark PerformanceTest, BurnInTest, and OSForensics are benchmarking and diagnostics tools that include a system driver (DirectIo64.sys) to measure hardware performance. An unprivileged local user can exploit an unauthenticated IOCTL handler in this driver to dump all physical memory to a file they control, exposing sensitive data from other users' processes and defeating kernel address space layout randomization (KASLR). The vulnerability also allows writing files to system-protected directories and can crash the kernel on certain system configurations.

Technologies: [PassMark BurnInTest](https://junglewise.ai/threats/technologies/burnintest), [PassMark OSForensics](https://junglewise.ai/threats/technologies/osforensics), [PassMark PerformanceTest](https://junglewise.ai/threats/technologies/performancetest). Vendors: [PassMark](https://junglewise.ai/threats/vendors/passmark).

## Quick answers

**Is CVE-2026-80118 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80118 being exploited in the wild.

**How severe is CVE-2026-80118?** High severity, with a CVSS score of 7.1, published 4 September 2026.

**Which products and versions are affected?** PassMark BurnInTest before 11.1 build 1000; PassMark OSForensics before 11.1 build 1016; PassMark PerformanceTest before 11.1 build 1012.

**Is there a fix for CVE-2026-80118?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-80118 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-80118?** Check whether you run PassMark BurnInTest, PassMark OSForensics or PassMark PerformanceTest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in DirectIo64.sys, a signed kernel-mode driver shipped by PassMark to provide hardware access. An IOCTL handler in the driver lacks caller-identity verification and accepts requests from any unprivileged local user (medium integrity level and above) without authentication. The handler implements a physical memory disclosure feature that writes crash-dump-format (PAGEDU64) images of all physical memory to caller-supplied file paths in the SYSTEM context, bypassing normal Windows access controls. The dump header exposes the kernel module list, active process list, and physical frame number (PFN) database pointers, defeating KASLR. Additionally, the same handler dereferences an unchecked return value from an internal kernel-structure locator without NULL validation, causing kernel crashes when one of three failure paths is triggered. Attack preconditions require either the driver to be loaded as a service without an exclusive handle, or code execution within an elevated PassMark process that holds an open device handle. Patches are available in PerformanceTest 11.1 build 1012 and later, BurnInTest 11.1 build 1000 and later, and OSForensics 11.1 build 1016 and later.

## Affected products

- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016

## Timeline

- 2026-09-04: disclosed: CVE-2026-80118 published
- 2026-08-28: other: Technical analysis published by dkom.dev

## References

- [https://dkom.dev/posts/directio64-disclosure/](https://dkom.dev/posts/directio64-disclosure/)
- [https://github.com/floppywiggler/directio64-disclosure](https://github.com/floppywiggler/directio64-disclosure)

## Related threats

- [PassMark DirectIo64.sys physical memory disclosure via IOCTL](https://junglewise.ai/threats/cve-2026-80119-passmark-directio64-sys-physical-memory-disclosure-via-ioctl)
- [PassMark DirectIo64.sys privilege escalation via unvalidated I/O port access](https://junglewise.ai/threats/cve-2026-80117-passmark-directio64-sys-privilege-escalation-via-unvalidated-i-o)
- [PassMark DirectIo64.sys privilege escalation](https://junglewise.ai/threats/cve-2026-80116-passmark-directio64-sys-privilege-escalation)
- [PassMark DirectIo64 privilege escalation and denial of service via insufficient IOCTL validation](https://junglewise.ai/threats/cve-2026-80115-passmark-directio64-privilege-escalation-and-denial-of-service)
- [PassMark DirectIo64.sys hardcoded credentials and privilege escalation](https://junglewise.ai/threats/cve-2026-80114-passmark-directio64-sys-hardcoded-credentials-and-privilege)