CVE-2026-80116: PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTL
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to modify hardware configuration by exploiting exposed IOCTLs with no validation on device selection, register offset, or value. Attackers can obtain a device handle and issue arbitrary PCI configuration space read/write operations to enable Bus Master DMA on any PCI device, halt storage controller I/O by clearing command registers, or remap Base Address Registers to redirect DMA to an attacker-chosen physical address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PassMark PerformanceTestto a version that resolves this vulnerability.Fixed in 11.1 build 1012 - Upgrade
Upgrade
BurnInTestto a version that resolves this vulnerability.Fixed in 11.1 build 1000 - Upgrade
Upgrade
OSForensicsto a version that resolves this vulnerability.Fixed in 11.1 build 1016
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs local access with low privileges. No user interaction is required, but the attacker must be able to obtain a handle to the DirectIo64.sys device and send IOCTL requests.
What could exploitation allow an attacker to do?
The exposed IOCTLs permit arbitrary PCI configuration-space reads and writes. An attacker can enable Bus Master DMA on PCI devices, disrupt storage controller I/O by clearing command registers, or remap Base Address Registers so DMA targets an attacker-chosen physical address.
Which product releases are affected?
Affected releases are PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016.