PassMark PerformanceTest CVE-2026-80116

The vulnerable driver DirectIo64.sys must be installed and loaded on the target Windows system, which occurs automatically when any of the three affected PassMark products are installed. The attacker requires a local, low-privileged user account (PR:L); remote or unauthenticated exploitation is not possible. No special configuration beyond product installation is required - the IOCTLs are exposed by default with no additional opt-in setting. Exploitation is limited to Windows systems (the driver is a Windows kernel-mode driver); Linux and macOS are not affected. The key limiting factor is the local attack vector: an adversary must already have a valid low-privileged session on the target machine, making this primarily a post-compromise privilege escalation primitive rather than an initial access vector.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately captures the core risk: local, low-privilege exploitation with no special attack conditions and full CIA impact on the vulnerable system. The threat is not theoretical - a public PoC repository (floppywiggler/directio64-disclosure) and a detailed technical writeup at dkom.dev confirm the technique is documented and reproducible. Real-world risk is elevated on shared or multi-tenant Windows environments, developer workstations running benchmarking tools, and IT labs where PassMark tools are routinely installed; even a mid-sized municipal IT team in walbrzych maintaining shared workstations with PassMark tools installed would face meaningful lateral-movement risk if a low-privileged account is compromised. No CISA KEV listing has been observed, and EPSS data was not provided, but the availability of working exploit code significantly lowers the bar for opportunistic exploitation. The primary limiting factor is the local attack vector: an adversary must already have a foothold on the target machine. However, once present, this driver provides a reliable, stable primitives path to SYSTEM-equivalent hardware control without needing a fragile memory-corruption exploit.

A low-privileged Windows user installs or finds a system with any of the three affected PassMark products present, then uses the publicly available PoC code from github.com/floppywiggler/directio64-disclosure to open a handle to DirectIo64.sys and issue IOCTLs writing to PCI configuration space. The attacker enables Bus Master DMA on an Ethernet or storage controller and redirects its BAR to a target physical memory page containing kernel data structures, achieving arbitrary physical memory read/write equivalent to kernel-mode access - without triggering modern exploit mitigations such as SMEP or CFG.