EUVD-2026-71684
GHSA-xw54-98c9-3f6v
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local low-privilege access to open device handle; scope changes to kernel upon PTE/code-page manipulation yielding full C/I/A.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to clear arbitrary bits at any physical memory address due to missing validation of the physical address parameter in an exposed IOCTL handler. Attackers can obtain a device handle and supply an arbitrary 64-bit physical address with a bit index to invoke MmMapIoSpace and clear bits in kernel code pages or page table entries, enabling local privilege escalation or system compromise.
AnalysisAI
Local privilege escalation to kernel in PassMark PerformanceTest, BurnInTest, and OSForensics allows a low-privileged local user to achieve arbitrary physical memory bit-clearing via an exposed, unvalidated IOCTL in the shared DirectIo64.sys kernel driver. By supplying a crafted 64-bit physical address and bit index to the driver, an attacker can invoke MmMapIoSpace to map and modify kernel code pages or page table entries, yielding full system compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable system must have one of the three PassMark products installed (PerformanceTest, BurnInTest, or OSForensics) in an unpatched version, which installs and loads the DirectIo64.sys kernel driver. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Despite a CVSS 4.0 base score of 6.9, the real-world risk of this vulnerability is materially higher than the score suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the patched builds immediately: PassMark PerformanceTest 11.1 build 1012 or later (https://www.passmark.com/products/performancetest/history.php), BurnInTest 11.1 build 1000 or later (https://www.passmark.com/products/burnintest/history.php), and OSForensics 11.1 build 1016 or later (https://www.osforensics.com/whats-new.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Burnintest
View allAn issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. Rat
An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. Rat
Arbitrary physical memory write via a hard-coded cryptographic key in the shared Windows kernel driver DirectIo64.sys af
Full physical memory disclosure in PassMark's shared kernel driver DirectIo64.sys affects PerformanceTest (before 11.1 b
Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build
Unprivileged local users can issue privileged hardware IOCTLs through PassMark's DirectIo64.sys kernel driver across thr
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012),
An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 B
Privilege escalation and kernel DoS in PassMark's shared DirectIo64.sys kernel driver affect PerformanceTest (before 11.
Privilege escalation through the DirectIo64.sys kernel driver affects three PassMark products - PerformanceTest before b
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today