EUVD-2026-71686
GHSA-m6jq-8p5j-c6vp
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with low privilege suffices; scope change (S:C) applies because writing to a CPU MSR crashes the entire OS kernel, and C:L captures MSR-read KASLR bypass.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation and denial-of-service vulnerability in DirectIo64.sys that allows local attackers to read arbitrary Model-Specific Registers or write zero to any MSR through exposed IOCTLs with insufficient blocklist enforcement. Attackers can exploit the unrestricted write IOCTL to zero out the system call handler MSR, causing an immediate unrecoverable kernel crash on the next system call, or read security-sensitive MSRs used to locate kernel data structures.
AnalysisAI
Privilege escalation and kernel DoS in PassMark's shared DirectIo64.sys kernel driver affect PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allowing a local low-privileged attacker to read arbitrary Model-Specific Registers or write zero to any MSR via IOCTLs with an insufficient blocklist. Writing zero to the system call handler MSR (e.g., IA32_LSTAR) causes an immediate unrecoverable kernel panic on the next system call, while reading security-sensitive MSRs (such as those storing kernel base addresses) enables KASLR bypass to support privilege escalation chains. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | A local, authenticated Windows user-level account (standard, non-admin) is required - no elevated privileges are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H) scores 6.9, accurately reflecting that exploitation requires local authenticated access (PR:L) but imposes no other preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade PerformanceTest to 11.1 build 1012 or later, BurnInTest to 11.1 build 1000 or later, and OSForensics to 11.1 build 1016 or later using the respective vendor history pages. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Performancetest
View allAn issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. Rat
An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. Rat
Full physical memory disclosure in PassMark's shared kernel driver DirectIo64.sys affects PerformanceTest (before 11.1 b
Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build
Arbitrary physical memory write via a hard-coded cryptographic key in the shared Windows kernel driver DirectIo64.sys af
Unprivileged local users can issue privileged hardware IOCTLs through PassMark's DirectIo64.sys kernel driver across thr
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012),
An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 B
Local privilege escalation to kernel in PassMark PerformanceTest, BurnInTest, and OSForensics allows a low-privileged lo
Privilege escalation through the DirectIo64.sys kernel driver affects three PassMark products - PerformanceTest before b
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today