CVE-2026-80119 Overview
CVE-2026-80119 is an information disclosure vulnerability in the DirectIo64.sys kernel driver shipped with multiple PassMark products. The driver exposes an IOCTL that accepts a caller-controlled file path and writes the complete contents of physical memory to that path in the SYSTEM security context. An authenticated local attacker with low privileges can issue a single IOCTL call to dump full RAM, including LSASS working set, process memory, and cryptographic material from all running processes. The flaw is classified under CWE-73: External Control of File Name or Path and bypasses user-mode access control lists entirely.
Critical Impact
A local low-privileged user can extract credentials, keys, and sensitive process memory from every running process by triggering a single kernel driver IOCTL.
Affected Products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Discovery Timeline
- 2026-09-04 - CVE-2026-80119 published to the National Vulnerability Database
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-80119
Vulnerability Analysis
The DirectIo64.sys driver is loaded by PassMark PerformanceTest, BurnInTest, and OSForensics to support low-level hardware access. The driver exposes an IOCTL handler that accepts an arbitrary destination file path from user mode without validating the caller's privilege level or sanitizing the target path. When invoked, the driver enumerates every physical memory range on the system and writes those pages to the attacker-supplied location. Because the driver runs in kernel mode and the file write is performed in the SYSTEM context, standard file-system ACLs and user-mode isolation boundaries do not apply. The output is a complete image of physical RAM at the moment of the call.
Root Cause
The root cause is missing authorization and path validation on the IOCTL interface. The driver trusts unauthenticated local callers to specify a destination path and does not restrict which processes can invoke the memory-dump IOCTL. Combined with the driver's use of a documented mechanism to map the PhysicalMemory section object, this design turns a diagnostic capability into a physical memory read primitive available to any local user who can open a handle to the driver.
Attack Vector
Exploitation requires local access and the ability to open a handle to the DirectIo64 device object. The attacker calls DeviceIoControl with the memory-dump IOCTL code and a structure containing an attacker-chosen output path. The driver calls MmGetPhysicalMemoryRanges to enumerate installed RAM, then iterates each page and maps it through ZwMapViewOfSection against the \Device\PhysicalMemory section object. Each mapped page is written sequentially to the output file. The resulting image can be parsed offline with standard memory forensics tooling to extract LSASS secrets, Kerberos tickets, DPAPI keys, TLS session keys, and any plaintext data held in process working sets. Technical details are documented in the VulnCheck advisory and the dkom.dev disclosure post.
Detection Methods for CVE-2026-80119
Indicators of Compromise
- Presence of DirectIo64.sys loaded on hosts that do not require PassMark diagnostic tools.
- Creation of large files (approximating installed physical RAM size) with SYSTEM as the file owner, initiated by a non-SYSTEM user session.
- Handle opens to the DirectIo64 device object from processes that are not the legitimate PassMark applications.
- Unexpected invocations of DeviceIoControl targeting the DirectIo64 driver from unsigned or unusual binaries.
Detection Strategies
- Monitor Windows driver load events (Sysmon Event ID 6) for DirectIo64.sys and alert on installations outside authorized change windows.
- Flag file-create events where the file size approaches total physical memory and the parent process is a user-mode diagnostic or unknown binary.
- Correlate DeviceIoControl telemetry against a baseline of legitimate PassMark process ancestry.
Monitoring Recommendations
- Baseline which hosts require PassMark tooling and alert on the driver appearing elsewhere.
- Track file writes to unusual paths originating from kernel-context operations chained to a low-privilege user session.
- Review endpoint telemetry for LSASS handle access anomalies that may follow a successful memory dump.
How to Mitigate CVE-2026-80119
Immediate Actions Required
- Inventory all systems for the affected PassMark products and the DirectIo64.sys driver.
- Upgrade PerformanceTest to 11.1 build 1012 or later, BurnInTest to 11.1 build 1000 or later, and OSForensics to 11.1 build 1016 or later.
- Remove PassMark diagnostic tools from production endpoints where they are not required.
- Rotate credentials and cryptographic secrets on any host suspected of exposure, including cached domain credentials and service account passwords.
Patch Information
PassMark has released fixed builds. Update information is available in the PerformanceTest release history, the BurnInTest release history, and the OSForensics update page.
Workarounds
- Uninstall the vulnerable PassMark products until patched builds are deployed.
- Block loading of the vulnerable DirectIo64.sys driver using Microsoft's vulnerable driver blocklist or Windows Defender Application Control policies.
- Restrict local logon rights on sensitive hosts to reduce the population of users who can invoke the IOCTL.
- Apply Credential Guard and LSA protection to limit the value of a physical memory dump against LSASS.
# Example: query for the vulnerable driver on a Windows host
Get-ChildItem -Path C:\ -Recurse -Filter DirectIo64.sys -ErrorAction SilentlyContinue |
Select-Object FullName, VersionInfo
# Example: enumerate loaded kernel modules and filter for the driver
driverquery /v /fo csv | findstr /I DirectIo64
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
