PassMark PerformanceTest CVE-2026-80118

Exploitation requires a local interactive or Remote Desktop session as any standard (non-privileged) Windows user on a machine where PassMark PerformanceTest, BurnInTest, or OSForensics is installed and the DirectIo64.sys driver is loaded. No administrative rights, no special group membership, and no non-default configuration of the PassMark products are required - the IOCTL handler performs no caller-identity or privilege check whatsoever. The secondary NULL-dereference crash variant additionally requires that the targeted system's build triggers one of three specific internal failure paths in the kernel-structure locator, making it build-dependent. Exploitation is strictly limited to users with an active local or RDP session; unauthenticated network-only attackers cannot reach the kernel driver directly.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) accurately captures a low-friction local exploitation path requiring only a standard Windows user account - even a mid-sized municipal IT team in walbrzych managing shared workstations should treat this as urgent if any affected PassMark product is installed on multi-user endpoints. The combined confidentiality impact (all physical memory, including credentials, encryption keys, and in-memory secrets from every co-resident process) and integrity impact (SYSTEM-context file writes to otherwise-protected paths) make this a compelling lateral-movement and persistence enabler, well beyond a simple information leak. Publicly available exploit code exists (confirmed via GitHub repository), materially lowering the barrier to exploitation; no active exploitation has been confirmed in CISA KEV at time of analysis, so this is not confirmed in-the-wild but is close to trivially weaponizable. The KASLR defeat via the dump header adds utility as a preparatory step for follow-on kernel exploitation chains. The vendor's provided CVSS marks VA:N, likely reflecting focus on the primary exploitation path; the secondary NULL dereference crash on specific builds introduces a real, if conditional, availability risk that the score does not fully account for.

A standard domain user on a shared Windows workstation where PerformanceTest is installed opens a handle to DirectIo64.sys and issues a single crafted IOCTL specifying a writable output path; the driver - executing as SYSTEM - writes a full PAGEDU64 physical memory dump to that path, which the attacker then parses to extract LSASS credentials, browser session tokens, and KASLR-defeating kernel addresses. A public exploit repository (https://github.com/floppywiggler/directio64-disclosure) demonstrates this complete flow with no special tooling beyond a standard development environment.