CVE-2026-80118: PassMark Software Information Disclosure

CVE-2026-80118 Overview

CVE-2026-80118 is a physical memory disclosure vulnerability in the DirectIo64.sys kernel driver shipped with PassMark PerformanceTest, BurnInTest, and OSForensics. The driver exposes an IOCTL handler that performs no caller-identity check, allowing any unprivileged local user to dump all physical memory to an attacker-supplied file path in the SYSTEM security context. The dump uses the Windows crash-dump PAGEDU64 format and includes a header that leaks the kernel loaded-module list, active-process list, and PFN database pointers. The same handler also contains an unchecked kernel pointer dereference that can crash the system. The issue is tracked as CWE-73: External Control of File Name or Path.

Critical Impact
A standard user can read memory belonging to other users' processes, defeat KASLR, and write files to SYSTEM-only locations on any host running vulnerable PassMark software.

Affected Products

PassMark PerformanceTest before 11.1 build 1012
PassMark BurnInTest before 11.1 build 1000
PassMark OSForensics before 11.1 build 1016

Discovery Timeline

2026-09-04 - CVE-2026-80118 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80118

Vulnerability Analysis

The DirectIo64.sys driver ships as a signed helper component used by PassMark diagnostic tools to access hardware directly. It exposes a device object reachable from user mode without an ACL that restricts callers to administrators. A single IOCTL triggers a routine that maps physical memory and writes a crash-dump-format image to a file path supplied by the caller.

Because the write occurs in the SYSTEM context, the caller can target directories they cannot otherwise write to, including protected system paths. The resulting dump includes contents of processes owned by other users on the host, enabling recovery of credentials, tokens, and other secrets from live memory. See the DKom disclosure write-up and the VulnCheck advisory for full technical detail.

Root Cause

The root cause is missing access control on the driver's IOCTL interface combined with attacker-controlled file path handling in a privileged context. A secondary defect exists in the same handler: an internal kernel-structure locator can return NULL on three distinct failure paths, and its return value is dereferenced without a check. On builds where any of those paths is taken, the dereference causes a bugcheck.

Attack Vector

An unprivileged local user opens a handle to the driver's device object and issues the vulnerable IOCTL with a target file path and buffer. The driver writes a PAGEDU64 dump of all physical RAM to that path. The dump header exposes pointers into the kernel loaded-module list, active-process list, and PFN database, which defeats Kernel Address Space Layout Randomization (KASLR). A proof-of-concept is published at the floppywiggler/directio64-disclosure repository.

Detection Methods for CVE-2026-80118

Indicators of Compromise

Presence of DirectIo64.sys loaded on hosts that do not require PassMark diagnostic tooling.
Creation of large files with the PAGEDU64 crash-dump magic in the first bytes, in unusual locations such as user-writable paths or protected directories.
Unexpected CreateFile operations against the \\.\DirectIo64 device object by non-administrative processes.
Unscheduled bugchecks referencing DirectIo64.sys in the faulting module field of minidumps.

Detection Strategies

Alert on any process opening a handle to the DirectIo64 device that is not the signed PassMark application binary.
Hunt for newly created files whose first 8 bytes match the PAGEDU64 signature outside of %SystemRoot%\Minidump and %SystemRoot%\MEMORY.DMP.
Flag any non-SYSTEM process that causes SYSTEM-owned file writes into ACL-protected paths shortly after touching the driver device.

Monitoring Recommendations

Enable kernel driver load auditing and forward events to a centralized data lake for correlation.
Monitor Microsoft-Windows-Kernel-File ETW events for file creations by the System process attributed to DirectIo64.sys.
Track bugcheck telemetry from endpoints and correlate crash bucket IDs pointing at DirectIo64.sys.

How to Mitigate CVE-2026-80118

Immediate Actions Required

Upgrade PassMark PerformanceTest to 11.1 build 1012 or later, BurnInTest to 11.1 build 1000 or later, and OSForensics to 11.1 build 1016 or later.
Uninstall vulnerable PassMark products from hosts where they are not actively required.
Remove or block loading of legacy DirectIo64.sys copies that remain on disk after uninstall.
Review recent file writes to protected directories on affected hosts for signs of exploitation.

Patch Information

Fixed builds are available from the vendor. Refer to the PerformanceTest history page, the BurnInTest history page, and the OSForensics updates page for release notes.

Workarounds

Add DirectIo64.sys to the Microsoft vulnerable driver blocklist policy and enforce Hypervisor-Protected Code Integrity (HVCI).
Restrict local logon on sensitive systems to accounts that already hold administrative privilege, reducing exposure to unprivileged callers.
Apply an application control policy that prevents unsigned or non-approved processes from opening handles to the DirectIo64 device object.

bash

# Example: query for the vulnerable driver on a Windows host
sc.exe query DirectIo64
Get-ChildItem -Path C:\ -Recurse -Filter DirectIo64.sys -ErrorAction SilentlyContinue