CVE-2026-80119

PassMark's DirectIo64.sys kernel driver, shipped with PerformanceTest, BurnInTest and OSForensics, contains an information disclosure flaw that lets any local caller trigger a complete physical memory dump with a single IOCTL call. The driver accepts a caller-controlled file path, iterates all physical memory ranges via MmGetPhysicalMemoryRanges, maps each page through ZwMapViewOfSection on the PhysicalMemory section object, and writes a full RAM image to that path running as SYSTEM, bypassing user-mode ACLs. An attacker (or any local process able to reach the exposed IOCTL) gains access to the LSASS working set, process memory, and cryptographic material such as keys and credentials held by all running processes. Any Windows system running an affected version of PerformanceTest, BurnInTest, or OSForensics is affected. No public proof-of-concept, KEV listing, or known in-the-wild exploitation is reported, and EPSS places 30-day exploitation probability at about 0.1%.

What to do: Upgrade to PerformanceTest 11.1 build 1012, BurnInTest 11.1 build 1000, and OSForensics 11.1 build 1016 or later to obtain the fixed DirectIo64.sys driver. Because exploitation requires local code execution, prioritize multi-user machines and systems handling sensitive credentials or keys, and check Windows hosts for the presence of DirectIo64.sys and for unexpected full-memory image files written to disk. No public PoC or in-the-wild exploitation is currently known, so remediation can be scheduled with normal patch cycles.