CVE-2026-80112 Overview
CVE-2026-80112 is an improper access control vulnerability [CWE-732] affecting the DirectIo64.sys kernel driver bundled with PassMark PerformanceTest, BurnInTest, and OSForensics. The driver creates its device object without a security descriptor, causing Windows to apply a permissive default Access Control List (ACL). Unprivileged local users can open a handle to the device and issue I/O control codes (IOCTLs) that trigger privileged hardware operations. The flaw bypasses standard privilege and integrity level restrictions on affected systems.
Critical Impact
Local low-privileged users can invoke kernel-mode hardware operations through DirectIo64.sys, enabling potential privilege escalation, arbitrary physical memory access, and full compromise of confidentiality, integrity, and availability.
Affected Products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Discovery Timeline
- 2026-09-04 - CVE-2026-80112 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-80112
Vulnerability Analysis
The DirectIo64.sys driver ships with PassMark utilities to enable direct hardware access from user mode. The driver creates its device object using an API call that omits a security descriptor. Windows then applies a default ACL that grants access to any authenticated user, including low-integrity processes.
Once a handle is obtained, the attacker can send IOCTLs that instruct the driver to perform privileged operations. These operations typically include reading and writing physical memory, accessing I/O ports, and interacting with model-specific registers. Such primitives are sufficient to achieve local privilege escalation to SYSTEM and to tamper with kernel structures.
Root Cause
The root cause is the absence of a restrictive security descriptor on the driver's device object during creation. Without an explicit descriptor, Windows falls back to the default ACL, which does not restrict access to administrators. This design decision violates the principle of least privilege for kernel driver interfaces.
Attack Vector
Exploitation requires local access with any authenticated user context, including standard users and processes running at low integrity. The attacker opens a handle to the \\.\DirectIo64 device and issues driver-defined IOCTLs. No user interaction is required, and the attack complexity is low. The vulnerability manifests only after a vulnerable version of PerformanceTest, BurnInTest, or OSForensics has installed the driver on the host.
See the VulnCheck Advisory on Access Control and the Dkom Blog Post on Disclosure for full technical details.
Detection Methods for CVE-2026-80112
Indicators of Compromise
- Presence of DirectIo64.sys on hosts where PassMark tooling is not authorized or is installed at an outdated build.
- Handles to the \\.\DirectIo64 device object opened by processes that are not the PassMark application itself.
- Unexpected loading of DirectIo64.sys by the Windows Service Control Manager after user-mode process execution.
Detection Strategies
- Inventory endpoints for the DirectIo64.sys driver file and correlate installed versions against fixed builds.
- Alert on DeviceIoControl calls targeting \\.\DirectIo64 originating from non-PassMark binaries.
- Monitor for kernel driver load events (Windows Event ID 6) referencing DirectIo64.sys on systems that should not run PassMark utilities.
Monitoring Recommendations
- Enable Sysmon Event ID 6 (Driver Loaded) and forward events to a centralized analytics platform for anomaly review.
- Track process creation chains that lead to abnormal privilege changes or SYSTEM token acquisition following interaction with the driver.
- Baseline authorized PassMark installations and flag deviations, including installations on servers or production endpoints where diagnostic tooling is not expected.
How to Mitigate CVE-2026-80112
Immediate Actions Required
- Upgrade PerformanceTest to 11.1 build 1012 or later, BurnInTest to 11.1 build 1000 or later, and OSForensics to 11.1 build 1016 or later.
- Uninstall PassMark utilities from systems that do not actively require them, and confirm that DirectIo64.sys is removed.
- Restrict local logon and application installation rights on production hosts to reduce exposure to vulnerable driver installations.
Patch Information
PassMark has released fixed builds for each affected product. Refer to the PassMark PerformanceTest History, PassMark BurnInTest History, and OSForensics What's New Update pages for release notes and download links. The GitHub Repository for Disclosure documents the coordinated disclosure and remediation.
Workarounds
- Add DirectIo64.sys to the Microsoft Vulnerable Driver Blocklist to prevent loading of vulnerable versions.
- Enable Hypervisor-Protected Code Integrity (HVCI) and Smart App Control to block unsigned or blocklisted driver loads.
- Manually revoke access to the \\.\DirectIo64 device object by applying a restrictive ACL where uninstall is not feasible.
# Configuration example: enable Microsoft Vulnerable Driver Blocklist via registry
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
