CVE-2026-80113 in BurnInTest
Summary
by MITRE • 09/04/2026
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to clear arbitrary bits at any physical memory address due to missing validation of the physical address parameter in an exposed IOCTL handler. Attackers can obtain a device handle and supply an arbitrary 64-bit physical address with a bit index to invoke MmMapIoSpace and clear bits in kernel code pages or page table entries, enabling local privilege escalation or system compromise.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in PassMark PerformanceTest prior to version 11.1 build 1012, BurnInTest prior to version 11.1 build 1000, and OSForensics prior to version 11.1 build 1016 stems from a critical flaw within the DirectIo64.sys driver component. This issue is classified as an improper input validation vulnerability that leads to privilege escalation. The core technical defect lies in the IOCTL handler exposed by the driver, which fails to perform adequate bounds checking or validity verification on the physical address parameter provided by user-mode applications. In Windows kernel architecture, drivers often expose interfaces via DeviceIoControl calls, allowing user-space processes to interact with hardware and kernel memory. When such an interface lacks rigorous validation of input parameters like physical addresses, it creates a pathway for malicious actors to manipulate low-level system resources directly.
The operational mechanism of this exploit involves an attacker first obtaining a handle to the vulnerable device object associated with DirectIo64.sys. Once access is granted, the attacker can invoke specific IOCTL codes that trigger the flawed handler function. By supplying an arbitrary 64-bit physical address along with a bit index, the malicious code forces the system to call MmMapIoSpace. This kernel routine maps the specified physical memory into virtual address space for direct manipulation. Because there is no check ensuring the target address resides in user-accessible or safe regions, the driver proceeds to clear specific bits at the requested physical location. This capability effectively allows an unprivileged local user to write directly to critical kernel structures without proper authorization checks.
The impact of this vulnerability is severe, as it facilitates arbitrary code execution and full system compromise through privilege escalation. By targeting kernel code pages or page table entries (PTEs), an attacker can modify the memory protection attributes or overwrite function pointers within the operating system's core components. Clearing bits in PTEs can alter access permissions for specific memory regions, potentially making read-only executable pages writable or enabling execution of previously inaccessible memory areas. This manipulation allows the injection and execution of malicious shellcode with SYSTEM-level privileges, effectively bypassing all standard Windows security boundaries such as User Account Control (UAC) and kernel patch protection.
From a classification perspective, this vulnerability aligns closely with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write when considering the memory manipulation aspect. In terms of offensive tactics, it maps to MITRE ATT&CK techniques related to Privilege Escalation via Kernel Exploitation, specifically involving direct hardware access or driver exploitation. The ability to clear arbitrary bits in physical memory represents a sophisticated attack vector that undermines the integrity and confidentiality guarantees provided by the operating system's virtual memory manager.
Mitigation strategies primarily involve updating the affected software products to versions where this validation logic has been corrected. For PassMark PerformanceTest, users must upgrade to build 1012 or later; for BurnInTest, version 11.1 build 1000 or higher is required; and for OSForensics, build 1016 or newer addresses the issue. In environments where immediate patching is not feasible, restricting access to device handles associated with DirectIo64.sys through strict file system permissions can limit exposure. Additionally, deploying endpoint detection and response solutions that monitor for unusual IOCTL calls targeting kernel memory regions may help detect exploitation attempts in real-time. Ensuring that only trusted applications have permission to interact with low-level hardware drivers is a fundamental defense-in-depth measure against such privilege escalation vectors.