CVE-2026-80117: PassMark Software Privilege Escalation Flaw

CVE-2026-80117 Overview

CVE-2026-80117 is a local privilege escalation vulnerability in the DirectIo64.sys driver bundled with PassMark PerformanceTest, BurnInTest, and OSForensics. The driver exposes IOCTLs that permit arbitrary x86 IN and OUT instructions against any I/O port without an allowlist or port validation. A standard user who obtains a device handle can write to sensitive hardware ports, including the PS/2 controller, CPU reset, CMOS configuration, and interrupt controller ports. The result is hardware-level manipulation such as an immediate system reset from an unprivileged account. The flaw is tracked under CWE-782: Exposed IOCTL with Insufficient Access Control.

Critical Impact
Local low-privileged users can trigger immediate hardware resets and manipulate CMOS, interrupt controllers, and other low-level hardware state through unvalidated IOCTLs in DirectIo64.sys.

Affected Products

PassMark PerformanceTest before 11.1 build 1012
PassMark BurnInTest before 11.1 build 1000
PassMark OSForensics before 11.1 build 1016

Discovery Timeline

2026-09-04 - CVE-2026-80117 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-80117

Vulnerability Analysis

The DirectIo64.sys kernel driver ships with three PassMark products and provides user-mode access to legacy x86 port I/O for diagnostic purposes. The driver exposes IOCTLs that accept a caller-supplied port number and value, then execute the corresponding IN or OUT instruction in kernel context. No allowlist restricts which ports may be reached, and no ACL restricts which users may open the device.

This design gives any local user a direct path to hardware registers that are normally reserved for the kernel or firmware. Because the operation runs at ring 0, the driver becomes a signed primitive for arbitrary I/O port access, bypassing Windows user-mode I/O restrictions. The impact is confined to the local host but extends below the operating system to hardware state.

Root Cause

The root cause is missing input validation and missing access control on the exposed IOCTL interface. The driver treats every caller as trusted and forwards every port number to the CPU without a filter. This maps directly to CWE-782: Exposed IOCTL with Insufficient Access Control.

Attack Vector

An attacker with a standard user account opens a handle to the driver's device object and issues IOCTLs referencing sensitive ports. Writing specific values to the PS/2 controller port (0x64) or the reset control register (0xCF9) forces an immediate system reset. Writes to the CMOS index and data ports (0x70/0x71) corrupt firmware configuration, and writes to the programmable interrupt controller ports (0x20/0xA0) can disrupt interrupt delivery. See the VulnCheck advisory and the Dkom disclosure post for a full description of the exposed IOCTLs and affected port ranges.

No verified public exploit code is referenced in this advisory. Additional technical detail is available in the floppywiggler/directio64-disclosure GitHub repository.

Detection Methods for CVE-2026-80117

Indicators of Compromise

Presence of DirectIo64.sys on systems where PassMark PerformanceTest, BurnInTest, or OSForensics is not required.
Creation of a device handle to the DirectIo64 device object by processes running under standard user accounts.
Unexpected system reboots, CMOS resets, or interrupt controller anomalies on hosts that have the vulnerable driver installed.

Detection Strategies

Inventory endpoints for the vulnerable driver hash and version of DirectIo64.sys shipped with pre-patch PassMark builds.
Alert on CreateFile calls targeting the DirectIo64 device from non-administrative processes.
Correlate driver load events (Windows Event ID 6 in the Sysmon driver load channel) for DirectIo64.sys with subsequent unplanned reboots.

Monitoring Recommendations

Enable the Microsoft Vulnerable Driver Blocklist and monitor block events for DirectIo64.sys.
Track process ancestry for any user-mode binary that opens the driver device and issues DeviceIoControl calls.
Feed driver load telemetry and reboot events into a central analytics pipeline for cross-host anomaly detection.

How to Mitigate CVE-2026-80117

Immediate Actions Required

Upgrade PassMark PerformanceTest to 11.1 build 1012 or later, BurnInTest to 11.1 build 1000 or later, and OSForensics to 11.1 build 1016 or later.
Remove the vulnerable DirectIo64.sys from hosts that do not require the affected PassMark products.
Restrict local logon on systems that must retain the driver until patching is complete.

Patch Information

Vendor release notes documenting the fixed builds are available in the PerformanceTest history, the BurnInTest history, and the OSForensics update notes.

Workarounds

Add DirectIo64.sys to the Microsoft Vulnerable Driver Blocklist to prevent loading on Windows 10, Windows 11, and Windows Server hosts.
Apply an ACL to the driver's device object so that only administrators can open a handle where uninstall is not immediately feasible.
Uninstall PassMark PerformanceTest, BurnInTest, or OSForensics entirely on systems where the diagnostic functionality is not required.

bash

# Enable the Microsoft Vulnerable Driver Blocklist (Windows 11 / Server 2022+)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f