PassMark PerformanceTest CVE-2026-80117

The attacker must hold an authenticated local Windows session on a host where at least one of the three affected PassMark products is installed with the DirectIo64.sys driver loaded and its device object accessible (default post-install state). No elevated privileges are required - a standard, low-integrity Windows user account suffices, consistent with the CVSS PR:L metric. No special software configuration or feature flag is needed beyond the default product installation. Exploitation is strictly local: remote unauthenticated exploitation is not possible; a prior foothold yielding an interactive or command-line session is a prerequisite. Patched versions (PerformanceTest ≥ 11.1 build 1012, BurnInTest ≥ 11.1 build 1000, OSForensics ≥ 11.1 build 1016) are not affected.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H, score 6.9) accurately characterises the threat: local access required, low privilege, no attack prerequisites, no confidentiality impact, but high integrity and availability impact. Real-world risk is moderate-to-elevated for environments where any of the three PassMark products is installed alongside untrusted or compromised local user accounts - a realistic scenario on shared workstations, IT labs, forensics investigation machines, or enterprise endpoints subject to lateral movement. The attack is mechanically trivial: any process can obtain a device handle with a single CreateFile call and issue the malicious IOCTL via DeviceIoControl, requiring no exploit sophistication beyond knowledge of the IOCTL code, which is now publicly documented. The public disclosure repository and technical write-up (dkom.dev/posts/directio64-disclosure) make weaponisation straightforward. The sole limiting factor is AV:L - the attacker must already hold an interactive or command-shell session as a standard user on a host running the affected software; unauthenticated remote exploitation is not possible.

A standard Windows user on a host with any affected PassMark product installed calls CreateFile targeting the DirectIo64 device object, then issues a DeviceIoControl call with the port-access IOCTL specifying I/O port 0xCF9 - the CPU hard-reset port - as the target, triggering an immediate forced system reboot with no warning. The public disclosure repository at github.com/floppywiggler/directio64-disclosure and the accompanying dkom.dev technical write-up document the IOCTL interface in sufficient detail to reproduce the attack without additional reverse engineering.