CVE-2026-80112

An improper access control flaw (CWE-732) exists in the DirectIo64.sys kernel driver shipped with PassMark PerformanceTest, BurnInTest, and OSForensics: the driver creates its device object without a security descriptor, so the permissive default Windows ACL applies. Any unprivileged local user can therefore open a handle to the device and issue IOCTLs that perform restricted, privileged hardware operations, regardless of the caller's privilege or integrity level. Successful abuse effectively gives a low-privileged local account elevated hardware access on the affected machine, consistent with the CVSS 4.0 score of 8.5, which rates high impact to confidentiality, integrity, and availability on the vulnerable system. Users running affected versions of any of the three Windows tools are exposed, with the greatest risk on shared or multi-user machines where untrusted local accounts can log in. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is reported, and EPSS currently estimates only a 0.1% probability of exploitation in the next 30 days.

What to do: Upgrade to PerformanceTest 11.1 build 1012 or later, BurnInTest 11.1 build 1000 or later, and OSForensics 11.1 build 1016 or later, each of which ships a corrected DirectIo64.sys driver. Prioritize patching shared or multi-user Windows systems (labs, test benches, forensic workstations) where untrusted local accounts can log in. As an interim measure, restrict the device object's ACL or remove/unload the driver on systems that do not actively need these tools.