important · Physical — Windows
A signed PassMark driver lets a standard Windows user read physical memory and chain hardware primitives to SYSTEM.
Affects
PassMark PerformanceTest, BurnInTest and OSForensics, Windows benchmarking, stress-testing and forensic utilities that install a signed kernel helper driver.
The vulnerable driver must be loaded and its device obtainable, but its permissive ACL then exposes physical-memory, MSR, PCI, I/O-port, and privileged-file operations.
Detail and 10 sources
Public code uses those operations to locate kernel process structures, bypass write gates, and replace the caller’s process token with SYSTEM.
PassMark release notes identify a corrected DirectIO driver.
Sources
ResearchPassMark PerformanceTest version historyResearchPassMark BurnInTest software - PC Reliability and Load TestingResearchOSForensics - What's new version historyCode / PoCdirectio64-disclosure/POCs at main · floppywiggler/directio64-disclosure · GitHubCode / PoCdirectio64-disclosure/POCs/CVE-2026-80112 at main · floppywiggler/directio64-disclosure · GitHubCode / PoCdirectio64-disclosure/POCs/CVE-2026-80119 at main · floppywiggler/directio64-disclosure · GitHubCode / PoCdirectio64-disclosure/POCs/CVE-2026-80114 at main · floppywiggler/directio64-disclosure · GitHubCode / PoCdirectio64-disclosure/POCs/CVE-2026-80118 at main · floppywiggler/directio64-disclosure · GitHubVendorPassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys | Advisories | VulnCheckSecondarySigned DirectIo64 driver exposes physical memory, PCI configuration and kernel privilege primitives