CVE-2026-80114 Overview
CVE-2026-80114 is a hard-coded credentials vulnerability [CWE-321] in the DirectIo64.sys kernel driver distributed with PassMark PerformanceTest, BurnInTest, and OSForensics. The driver embeds an 8-byte authentication key as a literal in the binary. Local attackers can extract the key, compute valid MD5 authentication tags for IOCTL requests, and perform arbitrary physical memory writes. A secondary validation gate can also be bypassed by using the driver's own bit-clear IOCTL to flip a single bit in the gating instruction's displacement byte, disabling subsequent MAC verification, size checks, and Vendor ID checks entirely.
Critical Impact
Local low-privileged users can achieve kernel-level compromise through arbitrary physical memory writes, leading to full system takeover.
Affected Products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Discovery Timeline
- 2026-09-04 - CVE-2026-80114 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-80114
Vulnerability Analysis
The DirectIo64.sys driver ships with an 8-byte key embedded directly in the distributed binary. The driver authenticates privileged IOCTL requests by verifying an MD5 tag computed over the request using this shared key. Because the key is static and recoverable from the binary, any local user able to open a handle to the driver can compute valid tags for arbitrary write requests.
The driver exposes IOCTLs that write to physical memory. Once an attacker forges a valid MAC, the driver accepts write primitives that map to physical RAM, allowing modification of kernel structures, code pages, or security-critical data.
A secondary validation gate is intended to restrict access further via size checks and Vendor ID checks. Attackers bypass this gate using the driver's own bit-clear IOCTL to clear a single bit in the displacement byte of the gating instruction. After this patch, the driver skips MAC verification, size validation, and Vendor ID enforcement on all subsequent write requests.
Root Cause
The root cause is the use of hard-coded credentials [CWE-321] in a signed kernel driver. Storing a shared authentication key as a binary literal violates the trust boundary between user mode and kernel mode. The bit-clear IOCTL compounds the defect by allowing the driver to modify its own gating logic at runtime.
Attack Vector
Exploitation requires local access and low privileges. An attacker extracts the 8-byte key from the driver binary using static analysis, opens a handle to DirectIo64.sys, and submits IOCTLs with valid MD5 tags. Alternatively, the attacker issues the bit-clear IOCTL to disable authentication entirely, then issues unconstrained physical memory writes.
Refer to the VulnCheck Advisory and the Dkom Disclosure Blog for technical exploitation details. Proof-of-concept material is published in the directio64-disclosure GitHub repository.
Detection Methods for CVE-2026-80114
Indicators of Compromise
- Presence of DirectIo64.sys on endpoints not actively running PassMark diagnostic or forensics tooling.
- Process handles opened to the DirectIo64 device object by non-PassMark parent processes.
- Unexpected loads of DirectIo64.sys from user-writable directories or temporary paths.
- Kernel memory or code integrity anomalies coinciding with driver activity.
Detection Strategies
- Inventory installed driver versions and flag DirectIo64.sys builds preceding the fixed releases.
- Alert on DeviceIoControl calls targeting the DirectIo64 device from non-approved processes.
- Apply Microsoft's vulnerable driver blocklist and monitor for blocked-load events.
- Correlate driver load events with subsequent kernel integrity violations or unsigned code execution.
Monitoring Recommendations
- Enable Windows Defender Application Control (WDAC) with the recommended driver blocklist.
- Ingest Sysmon Event ID 6 (driver load) and 11 (file create) into a central data lake for hunting.
- Track service creation and driver registration events referencing DirectIo64.
- Baseline expected PassMark tool usage and alert on deviations.
How to Mitigate CVE-2026-80114
Immediate Actions Required
- Upgrade PerformanceTest to 11.1 build 1012 or later, BurnInTest to 11.1 build 1000 or later, and OSForensics to 11.1 build 1016 or later.
- Remove DirectIo64.sys from systems that do not require PassMark tooling.
- Enforce Microsoft's vulnerable driver blocklist across managed endpoints.
- Restrict local administrative access on systems where the driver must remain installed.
Patch Information
PassMark has released fixed versions. Consult the PerformanceTest release history, the BurnInTest release history, and the OSForensics update page for build details and download links.
Workarounds
- Uninstall affected PassMark products until patched builds are deployed.
- Deny non-administrative users the ability to load or interact with the driver via WDAC or AppLocker policy.
- Block creation of the DirectIo64 service on endpoints that do not require it.
- Monitor for handle acquisition to the DirectIo64 device object and terminate unauthorized callers.
# Example: enforce Microsoft recommended driver blocklist via WDAC
CiTool.exe --update-policy "SiPolicy_DriverBlockList.p7b"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
