CVE-2026-80114

The DirectIo64.sys kernel driver shipped with PassMark's PerformanceTest, BurnInTest, and OSForensics authenticates IOCTL write requests using an MD5-based message authentication code keyed by an 8-byte value embedded as a hard-coded literal in the distributed binary (CWE-321). A local attacker with low privileges can extract this key from the binary on disk and compute valid MD5 tags for arbitrary physical memory write requests. The driver also exposes a secondary bypass: the attacker can use the driver's own bit-clear IOCTL to flip a single bit in the displacement byte of the gating instruction, causing all subsequent write requests to skip MAC verification, size checks, and Vendor ID checks entirely. Successful exploitation yields arbitrary physical memory writes from user mode, effectively providing kernel-level memory write access and a path to privilege escalation on the local machine. There is no evidence of exploitation in the wild: no public proof-of-concept, not listed in CISA KEV, and EPSS puts 30-day exploitation probability at 0.1%.

What to do: Upgrade to PerformanceTest 11.1 build 1012 or later, BurnInTest 11.1 build 1000 or later, and OSForensics 11.1 build 1016 or later, which ship a patched DirectIo64.sys. Because the driver may persist after the application is removed, check Windows systems for the presence of DirectIo64.sys (and older copies left on disk) and remove or replace outdated versions. Since exploitation requires local access, prioritize hosts where multiple unprivileged users can run code.