PassMark PerformanceTest CVE-2026-80113

The vulnerable system must have one of the three PassMark products installed (PerformanceTest, BurnInTest, or OSForensics) in an unpatched version, which installs and loads the DirectIo64.sys kernel driver. The attacker must have local interactive access with low-privilege credentials sufficient to open a device handle - no administrative token, no special group membership, and no service account is required. Exploitation is limited to Windows systems (the driver is a Windows kernel module); non-Windows deployments are unaffected. The attack requires no network connectivity, no user interaction beyond the attacker's own session, and no non-default configuration changes. The only limiting factor is local user access to a machine where one of the three PassMark products is installed.

Despite a CVSS 4.0 base score of 6.9, the real-world risk of this vulnerability is materially higher than the score suggests. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H reflects only the direct write primitive and omits the full downstream confidentiality impact achievable once kernel code execution is established - kernel-level compromise inherently grants C:H. A low-privilege local user with no prerequisites beyond having one of the three affected PassMark products installed can obtain a device handle and immediately launch the attack; no elevated token, no special group membership, and no user interaction are required. The publicly available PoC at github.com/floppywiggler/directio64-disclosure reduces exploitation skill requirements significantly. No active exploitation has been confirmed by CISA KEV at time of analysis, limiting immediate threat actor pressure, but the combination of low-privilege local access, published PoC, and kernel-level impact makes this a high-priority patch for any system where PassMark tools are installed, particularly shared workstations, VDI environments, or forensic analyst machines where multiple users have local access.

A low-privileged user on a Windows workstation with any of the three PassMark tools installed opens a handle to the DirectIo64 device and sends a crafted IOCTL containing a 64-bit physical address pointing to a page table entry that controls the attacker's own user-mode page and a bit index targeting the supervisor/user privilege bit. The driver maps the physical PTE via MmMapIoSpace without validating the address and clears the privilege bit, promoting the attacker's page to kernel-accessible memory or directly modifying kernel code. A public PoC demonstrating this technique is available at https://github.com/floppywiggler/directio64-disclosure.