CVE-2026-80116

PassMark Software's DirectIo64.sys kernel driver, shipped with PerformanceTest, BurnInTest, and OSForensics, exposes IOCTLs that perform PCI configuration space read/write operations without validating the target device, register offset, or value being written (CWE-782). A local user with low privileges can obtain a device handle and issue arbitrary IOCTL calls, which the driver executes directly against PCI hardware. By exploiting this, an attacker can enable Bus Master DMA on any PCI device, clear a storage controller's command registers to halt disk I/O (denial of service), or remap Base Address Registers to redirect DMA to an attacker-chosen physical address, giving high impact on the local system's confidentiality, integrity, and availability (CVSS 4.0: 8.5 High, local vector, low privileges required, no user interaction). Only systems running the affected versions of these three PassMark tools are affected; the flaw requires local code execution, so single-user workstations are lower risk than shared diagnostic, benchmarking, or forensic lab machines where multiple users run these utilities. There is no known public proof-of-concept, the CVE is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.1%, so no exploitation has been observed.

What to do: Upgrade to the fixed builds: PerformanceTest 11.1 build 1012 or later, BurnInTest 11.1 build 1000 or later, and OSForensics 11.1 build 1016 or later. On shared or multi-user Windows machines where these tools are installed, restrict local interactive access and inventory which systems have DirectIo64.sys loaded, prioritizing shared diagnostic, benchmarking, and forensic workstations where any local user can reach the vulnerable driver.