PassMark PerformanceTest CVE-2026-80119

Any local user-mode process with sufficient privilege to open a handle to the DirectIo64.sys device object can trigger the vulnerability - no administrative rights are required, only local code execution. The driver must be present on the system, which is the case whenever PerformanceTest, BurnInTest, or OSForensics is installed in a version prior to the fixed builds. The attack requires only a single IOCTL call with a caller-controlled file path; no prior authentication to the PassMark application is needed, and no special runtime configuration of the software must be active. Exploitation is limited to Windows (the driver is Windows-only), requires physical or remote-shell access to the target machine, and does not function if the PassMark driver is not loaded (e.g., if the software has not been launched since last reboot and the driver is set to manual start). The write destination is constrained only by filesystem reachability in SYSTEM context, meaning attacker-specified paths that low-privileged user ACLs would normally reject are accessible.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.5, reflecting a local, low-complexity, low-privilege exploit with high CIA impact on the vulnerable system. The primary real-world risk is credential theft: the attack pattern directly targets LSASS working-set memory and in-use cryptographic material, making it highly relevant as a lateral-movement enabler or credential-harvesting step following initial access. The arbitrary SYSTEM-context write (VI:H) is also significant and could overwrite critical system files, though VA:H in the supplied vector may overstate availability impact - causing a BSOD is possible but incidental and not the stated attacker objective. EPSS data was not supplied in the input; however, the combination of a public POC (GitHub, VulnCheck advisory, technical blog post at dkom.dev) and broad deployment across performance-testing and forensics workstations elevates practical risk above base-score CVSS alone would suggest. No CISA KEV listing indicates no confirmed widespread exploitation at time of analysis. The exploit is fully described and the PoC is mature, meaning the barrier to weaponization is low for any attacker already holding local access. Defenders should treat this as a high-priority post-exploitation tool in red-team chains targeting credential extraction.

An attacker with a low-privileged Windows account on a workstation where any PassMark product is installed opens a handle to DirectIo64.sys and issues a single crafted IOCTL call specifying an attacker-writable output path. The driver, running as SYSTEM, silently enumerates all physical RAM pages and writes a raw memory image to the specified file - a GitHub proof-of-concept demonstrates this end-to-end. The attacker then parses the dump offline using standard tools (e.g., Volatility) to extract NTLM hashes, Kerberos tickets, and plaintext credentials from the LSASS working set for lateral movement across the environment.