CVE-2026-80118

CVE-2026-80118 is an unauthenticated physical memory disclosure in the DirectIo64.sys kernel driver shipped with PassMark PerformanceTest, BurnInTest and OSForensics on Windows, where an IOCTL handler performs no caller-identity check and is reachable by any unprivileged local user. A single IOCTL causes the driver to write a crash-dump-format (PAGEDU64) image of all physical memory to a caller-supplied file path in SYSTEM context, so a standard user can create files in locations they cannot normally write and recover memory belonging to other users' processes; the image header also leaks the kernel loaded-module list, active-process list and PFN database pointers, defeating KASLR. The same handler additionally dereferences the return value of an internal kernel-structure locator without a NULL check, and on three distinct failure paths this triggers a kernel crash, adding a local availability impact. Anyone running affected builds of these tools is affected, with shared or multi-user Windows hosts the most consequential case. Exploitation status is currently none known: there is no public PoC, the flaw is not in CISA KEV, and EPSS estimates about a 0.1% probability of exploitation in the next 30 days.

What to do: Upgrade to PerformanceTest 11.1 build 1012 or later, BurnInTest 11.1 build 1000 or later, and OSForensics 11.1 build 1016 or later, and confirm on each Windows endpoint that the updated DirectIo64.sys driver is in place. Prioritize shared and multi-user machines, where any standard user could dump other users' memory or write SYSTEM-context files; if patching must wait, removing the vulnerable DirectIo64.sys driver from endpoints where the tools are unused eliminates exposure. Also treat the unpatched NULL-pointer dereference as a local denial-of-service (kernel crash) risk until fixed builds are deployed.