PassMark PerformanceTest CVE-2026-80115

A local, authenticated Windows user-level account (standard, non-admin) is required - no elevated privileges are needed. The vulnerable DirectIo64.sys driver must be installed and loaded, which occurs as a side effect of installing any of the three affected PassMark products. No special configuration beyond installation is needed; the driver loads automatically with the product. The DoS primitive (MSR zeroing) takes effect on the next system call by any process on the system after the IOCTL is issued, meaning the crash is immediate and affects all users. The MSR read path similarly requires only a handle to the driver device. Exploitation is limited to Windows hosts with one of the three PassMark products installed; the driver is not present by default on any Windows version.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H) scores 6.9, accurately reflecting that exploitation requires local authenticated access (PR:L) but imposes no other preconditions. The VA:H rating is well-founded: zeroing the LSTAR MSR causes an immediate, unrecoverable kernel crash with no mitigation possible at runtime. The VC:L rating reflects that MSR reads yield security-sensitive kernel addresses rather than user data directly. No EPSS data was supplied; no CISA KEV listing exists, indicating no confirmed in-the-wild exploitation. However, a public proof-of-concept is available on GitHub (floppywiggler/directio64-disclosure), lowering the exploitation bar significantly for any local attacker. The real-world risk is elevated for environments where these benchmarking or forensics tools are installed on shared or multi-user Windows systems, since a standard user account is sufficient to trigger an instant kernel crash, making this a reliable local DoS/sabotage primitive. The MSR read path is a meaningful KASLR bypass for exploit chain development on affected machines, though chaining to full privilege escalation would require an additional vulnerability. Risk is bounded by the requirement for interactive or shell-level local access.

A standard Windows user account on a machine with PassMark PerformanceTest installed opens a handle to the DirectIo64.sys device, then calls the write IOCTL targeting MSR index 0xC0000082 (IA32_LSTAR) with a zero payload. On the next system call executed by any process on the system, the CPU dereferences the null entry point, causing an immediate and unrecoverable kernel panic (BSOD), crashing all running processes and causing data loss. A public proof-of-concept on GitHub provides ready-made IOCTL call templates, requiring no kernel development expertise.