PassMark BurnInTest/OSForensics/PerformanceTest IOCTL DirectIo64.sys privileges management

Summaryinfo

A vulnerability, which was classified as very critical, was found in PassMark BurnInTest, OSForensics and PerformanceTest. Affected is an unknown function of the file DirectIo64.sys of the component IOCTL Handler. The manipulation results in privileges management. This vulnerability is identified as CVE-2026-80116. The attack is only possible with local access. There is not any exploit available.

Detailsinfo

A vulnerability was found in PassMark BurnInTest, OSForensics and PerformanceTest (affected version not known). It has been classified as very critical. Affected is some unknown functionality of the file DirectIo64.sys of the component IOCTL Handler. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to modify hardware configuration by exploiting exposed IOCTLs with no validation on device selection, register offset, or value. Attackers can obtain a device handle and issue arbitrary PCI configuration space read/write operations to enable Bus Master DMA on any PCI device, halt storage controller I/O by clearing command registers, or remap Base Address Registers to redirect DMA to an attacker-chosen physical address.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-80116 since 08/25/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/04/2026). The MITRE ATT&CK project declares the attack technique as T1068.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• PassMark

Name

• BurnInTest
• OSForensics
• PerformanceTest

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion