High severity · published Sep 4, 2026
CVE-2026-80112
PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening a handle to the device object created without a security descriptor. Attackers can issue IOCTLs through the permissive default Windows ACL applied to the device to access restricted hardware operations regardless of privilege or integrity level.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
BurnInTest · PassMark Software
before 11.1 build 1000 · source: vendor
OS
OSForensics · PassMark Software
before 11.1 build 1016 · source: vendor
PE
PerformanceTest · PassMark Software
before 11.1 build 1012 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80112
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80112
technical-description
https://github.com/floppywiggler/directio64-disclosure
release-notes
https://www.passmark.com/products/performancetest/history.php
release-notes
https://www.passmark.com/products/burnintest/history.php
release-notes
https://www.osforensics.com/whats-new.html
technical-description
https://dkom.dev/posts/directio64-disclosure/
third-party-advisory
https://www.vulncheck.com/advisories/passmark-performancetest-burnintest-and-osforensics-improper-access-control-via-directio64-sys
More from BurnInTest
7.8
CVE-2026-80119
PassMark PerformanceTest, BurnInTest, and OSForensics Physical Memory Disclosure via DirectIo64.sys IOCTL
7.8
CVE-2026-80116
PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTL
7.8
CVE-2026-80114
PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sys
7.1
CVE-2026-80118
PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTL
7.1
CVE-2026-80117
PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary I/O Port Access via DirectIo64.sys