Is CVE-2026-80119 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80119 being exploited in the wild.

How severe is CVE-2026-80119?

High severity, with a CVSS score of 7.8, published 4 September 2026.

Which products and versions are affected?

PassMark BurnInTest before 11.1 build 1000; PassMark OSForensics before 11.1 build 1016; PassMark PerformanceTest before 11.1 build 1012.

Is there a fix for CVE-2026-80119?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-80119 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-80119?

Check whether you run PassMark BurnInTest, PassMark OSForensics or PassMark PerformanceTest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80119: PassMark DirectIo64.sys physical memory disclosure via IOCTL

CVE-2026-80119 · Severity: high · CVSS 7.8 · Published 2026-09-04

PassMark's DirectIo64.sys driver, bundled with PerformanceTest, BurnInTest, and OSForensics, contains a vulnerability that allows local users to dump the entire system's physical memory contents. An attacker can extract sensitive data from all running processes—including passwords stored in memory (LSASS), encryption keys, and other confidential information—by issuing a single command to the driver with a file path where they want the memory image saved. This bypasses normal Windows security restrictions and runs with system privileges, exposing critical data even from administrator-protected processes.

Technologies: PassMark BurnInTest, PassMark OSForensics, PassMark PerformanceTest. Vendors: PassMark.

Quick answers

Is CVE-2026-80119 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80119 being exploited in the wild.
How severe is CVE-2026-80119?: High severity, with a CVSS score of 7.8, published 4 September 2026.
Which products and versions are affected?: PassMark BurnInTest before 11.1 build 1000; PassMark OSForensics before 11.1 build 1016; PassMark PerformanceTest before 11.1 build 1012.
Is there a fix for CVE-2026-80119?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-80119 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-80119?: Check whether you run PassMark BurnInTest, PassMark OSForensics or PassMark PerformanceTest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure flaw in the DirectIo64.sys signed driver stemming from improper access control and unsafe IOCTL handling. The root cause is that the driver creates its device object without a security descriptor (using IoCreateDevice instead of IoCreateDeviceSecure), leaving it accessible to any user at medium integrity or above. An unauthenticated local attacker can open a handle to the device and issue a specially crafted IOCTL that triggers the driver to iterate all physical memory ranges via MmGetPhysicalMemoryRanges, map each page to the PhysicalMemory section object using ZwMapViewOfSection, and write a complete RAM dump to an attacker-specified file path. The dump executes in SYSTEM context, circumventing user-mode access controls and exposing LSASS working set, process memory, and cryptographic material from all running processes. Attack preconditions are minimal: local access, medium integrity (standard user), and the device being accessible (not held exclusively by a PassMark product). Patches are available in PerformanceTest 11.1 build 1012, BurnInTest 11.1 build 1000, and OSForensics 11.1 build 1016.

Affected products

PassMark PerformanceTest before 11.1 build 1012
PassMark BurnInTest before 11.1 build 1000
PassMark OSForensics before 11.1 build 1016

Timeline

2026-09-04: disclosed: CVE-2026-80119 disclosed
2026-08-28: other: Technical deep-dive published on dkom.dev

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.