Monthly
Privilege escalation through the DirectIo64.sys kernel driver affects three PassMark products - PerformanceTest before build 1012, BurnInTest before build 1000, and OSForensics before build 1016 - allowing any local Windows user with low privileges to issue arbitrary x86 IN/OUT instructions to hardware I/O ports via exposed IOCTLs that lack allowlist or port-range validation. From a standard user account an attacker can write to PS/2 controller, CPU reset, CMOS configuration, and interrupt controller ports, triggering an immediate forced system reset or persistent hardware-level manipulation. A public technical disclosure repository (github.com/floppywiggler/directio64-disclosure) and accompanying blog post exist; no CISA KEV listing is present and no EPSS score was provided.
Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allows any low-privileged local user to gain complete hardware-level control over the host. The driver exposes IOCTLs without validating the target device, register offset, or value, enabling arbitrary PCI configuration space reads and writes. An attacker can leverage this to enable Bus Master DMA on any PCI device, remap Base Address Registers to attacker-controlled physical memory addresses, or halt storage controller I/O - all without kernel exploits. A public proof-of-concept is available; no active exploitation (CISA KEV) confirmed at time of analysis.
Privilege escalation and kernel DoS in PassMark's shared DirectIo64.sys kernel driver affect PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allowing a local low-privileged attacker to read arbitrary Model-Specific Registers or write zero to any MSR via IOCTLs with an insufficient blocklist. Writing zero to the system call handler MSR (e.g., IA32_LSTAR) causes an immediate unrecoverable kernel panic on the next system call, while reading security-sensitive MSRs (such as those storing kernel base addresses) enables KASLR bypass to support privilege escalation chains. A public proof-of-concept is available via GitHub, and vendor patches have been released; no KEV listing at time of analysis.
Local privilege escalation to kernel in PassMark PerformanceTest, BurnInTest, and OSForensics allows a low-privileged local user to achieve arbitrary physical memory bit-clearing via an exposed, unvalidated IOCTL in the shared DirectIo64.sys kernel driver. By supplying a crafted 64-bit physical address and bit index to the driver, an attacker can invoke MmMapIoSpace to map and modify kernel code pages or page table entries, yielding full system compromise. A public proof-of-concept is available and patches have been released by PassMark across all three affected product lines.
Local privilege escalation in the MBStorage DRAM lighting control module of GIGABYTE's Gigabyte Control Center (GCC) lets an authenticated low-privileged local user reach kernel-level privileges by abusing the bundled MyPortIO_x64.sys driver. The driver exposes IOCTL handlers without adequate access control, permitting arbitrary read and write of physical memory. No public exploit identified at time of analysis; the issue was reported by Taiwan's TWCERT and carries a CVSS 4.0 base score of 8.5 (High).
Local privilege escalation in MSI Feature Manager (GameGaraj) stems from its bundled KernCoreLib64.sys kernel driver exposing IOCTL handlers that any logged-on user can reach without administrator rights, granting arbitrary physical memory read/write and unrestricted I/O port access. Any low-privileged user on an affected Windows host can leverage this to manipulate kernel objects, tamper with kernel callbacks, bypass Protected Process Light (PPL), and disable endpoint security. Publicly available exploit code exists (published by VulnCheck), though there is no public exploit identified as being used in active attacks at time of analysis.
Local privilege escalation in NEC's ExpressUpdate Agent for Windows allows a low-privileged user who can already access the host to execute arbitrary code with SYSTEM privileges, owing to insufficient access controls on the agent. Reported by NEC under advisory NV26-004, the flaw carries a CVSS 4.0 base score of 8.5 (High) and maps to CWE-782 (exposed IOCTL with insufficient access control). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Physical memory exposure in the Generic IO & Memory Access Driver for Toshiba and Dynabook PCs allows any locally logged-in user - without administrative privileges - to access physical memory by invoking an insufficiently access-controlled IOCTL interface. Physical memory access of this kind typically enables both reading sensitive in-memory data (credentials, encryption keys, kernel structures) and writing to arbitrary memory addresses, making the effective impact broader than the vendor CVSS C:N rating suggests. No public exploit or CISA KEV listing has been identified at time of analysis; this was disclosed via JPCERT/JVN and a Sharp/Dynabook security advisory.
Anti-tampering bypass in Netskope Client for Windows (all versions prior to R138) allows a local administrator to send crafted IOCTL requests directly to the NSClient kernel driver, completely neutralizing the product's self-protection mechanisms. The flaw arises from CWE-782 - an IOCTL interface exposed by the driver without sufficient access controls - meaning a privileged insider can issue arbitrary control operations the driver was not designed to accept from untrusted callers. No public exploit has been identified at time of analysis, and exploitation is constrained to actors who already hold administrative privileges on the endpoint, limiting the realistic threat to insider scenarios or post-compromise lateral movement by an attacker who has already achieved admin-level access.
Local privilege escalation in PC Tools Internet Security (Symantec) is possible because the PCTCore64.sys kernel driver exposes its PCTCoreDriver WDM device interface to user-mode processes without adequate access controls, allowing low-privileged users to invoke privileged IOCTL handlers. CERT/CC tracked this as VU#158530 and the affected driver is a candidate for Microsoft's recommended driver block list; no public exploit identified at time of analysis, though the vulnerability class (BYOVD-style abuse) is well understood by attackers.
Privilege escalation through the DirectIo64.sys kernel driver affects three PassMark products - PerformanceTest before build 1012, BurnInTest before build 1000, and OSForensics before build 1016 - allowing any local Windows user with low privileges to issue arbitrary x86 IN/OUT instructions to hardware I/O ports via exposed IOCTLs that lack allowlist or port-range validation. From a standard user account an attacker can write to PS/2 controller, CPU reset, CMOS configuration, and interrupt controller ports, triggering an immediate forced system reset or persistent hardware-level manipulation. A public technical disclosure repository (github.com/floppywiggler/directio64-disclosure) and accompanying blog post exist; no CISA KEV listing is present and no EPSS score was provided.
Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allows any low-privileged local user to gain complete hardware-level control over the host. The driver exposes IOCTLs without validating the target device, register offset, or value, enabling arbitrary PCI configuration space reads and writes. An attacker can leverage this to enable Bus Master DMA on any PCI device, remap Base Address Registers to attacker-controlled physical memory addresses, or halt storage controller I/O - all without kernel exploits. A public proof-of-concept is available; no active exploitation (CISA KEV) confirmed at time of analysis.
Privilege escalation and kernel DoS in PassMark's shared DirectIo64.sys kernel driver affect PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allowing a local low-privileged attacker to read arbitrary Model-Specific Registers or write zero to any MSR via IOCTLs with an insufficient blocklist. Writing zero to the system call handler MSR (e.g., IA32_LSTAR) causes an immediate unrecoverable kernel panic on the next system call, while reading security-sensitive MSRs (such as those storing kernel base addresses) enables KASLR bypass to support privilege escalation chains. A public proof-of-concept is available via GitHub, and vendor patches have been released; no KEV listing at time of analysis.
Local privilege escalation to kernel in PassMark PerformanceTest, BurnInTest, and OSForensics allows a low-privileged local user to achieve arbitrary physical memory bit-clearing via an exposed, unvalidated IOCTL in the shared DirectIo64.sys kernel driver. By supplying a crafted 64-bit physical address and bit index to the driver, an attacker can invoke MmMapIoSpace to map and modify kernel code pages or page table entries, yielding full system compromise. A public proof-of-concept is available and patches have been released by PassMark across all three affected product lines.
Local privilege escalation in the MBStorage DRAM lighting control module of GIGABYTE's Gigabyte Control Center (GCC) lets an authenticated low-privileged local user reach kernel-level privileges by abusing the bundled MyPortIO_x64.sys driver. The driver exposes IOCTL handlers without adequate access control, permitting arbitrary read and write of physical memory. No public exploit identified at time of analysis; the issue was reported by Taiwan's TWCERT and carries a CVSS 4.0 base score of 8.5 (High).
Local privilege escalation in MSI Feature Manager (GameGaraj) stems from its bundled KernCoreLib64.sys kernel driver exposing IOCTL handlers that any logged-on user can reach without administrator rights, granting arbitrary physical memory read/write and unrestricted I/O port access. Any low-privileged user on an affected Windows host can leverage this to manipulate kernel objects, tamper with kernel callbacks, bypass Protected Process Light (PPL), and disable endpoint security. Publicly available exploit code exists (published by VulnCheck), though there is no public exploit identified as being used in active attacks at time of analysis.
Local privilege escalation in NEC's ExpressUpdate Agent for Windows allows a low-privileged user who can already access the host to execute arbitrary code with SYSTEM privileges, owing to insufficient access controls on the agent. Reported by NEC under advisory NV26-004, the flaw carries a CVSS 4.0 base score of 8.5 (High) and maps to CWE-782 (exposed IOCTL with insufficient access control). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Physical memory exposure in the Generic IO & Memory Access Driver for Toshiba and Dynabook PCs allows any locally logged-in user - without administrative privileges - to access physical memory by invoking an insufficiently access-controlled IOCTL interface. Physical memory access of this kind typically enables both reading sensitive in-memory data (credentials, encryption keys, kernel structures) and writing to arbitrary memory addresses, making the effective impact broader than the vendor CVSS C:N rating suggests. No public exploit or CISA KEV listing has been identified at time of analysis; this was disclosed via JPCERT/JVN and a Sharp/Dynabook security advisory.
Anti-tampering bypass in Netskope Client for Windows (all versions prior to R138) allows a local administrator to send crafted IOCTL requests directly to the NSClient kernel driver, completely neutralizing the product's self-protection mechanisms. The flaw arises from CWE-782 - an IOCTL interface exposed by the driver without sufficient access controls - meaning a privileged insider can issue arbitrary control operations the driver was not designed to accept from untrusted callers. No public exploit has been identified at time of analysis, and exploitation is constrained to actors who already hold administrative privileges on the endpoint, limiting the realistic threat to insider scenarios or post-compromise lateral movement by an attacker who has already achieved admin-level access.
Local privilege escalation in PC Tools Internet Security (Symantec) is possible because the PCTCore64.sys kernel driver exposes its PCTCoreDriver WDM device interface to user-mode processes without adequate access controls, allowing low-privileged users to invoke privileged IOCTL handlers. CERT/CC tracked this as VU#158530 and the affected driver is a candidate for Microsoft's recommended driver block list; no public exploit identified at time of analysis, though the vulnerability class (BYOVD-style abuse) is well understood by attackers.