PassMark PerformanceTest EUVD-2026-71683

The vulnerable PassMark product (PerformanceTest, BurnInTest, or OSForensics) must be installed on the target Windows system, which causes DirectIo64.sys to be loaded and its device object to be registered. The attacker requires a local, authenticated Windows session at any privilege or integrity level - including standard user accounts and low-integrity processes. No administrator credentials, no specific non-default configuration, and no special runtime state are required beyond the driver being present and loaded. Exploitation is not possible remotely over a network without prior local access. The key limiting factor is therefore local access: internet-facing systems without local user accounts or interactive login exposure are not directly reachable, but any shared workstation, RDP-accessible machine, or VDI environment running these PassMark tools is fully in scope.

The CVSS 4.0 score of 8.5 with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H accurately reflects the threat profile: local access is required, but once achieved, exploitation is trivial and fully automated. The availability of a public PoC on GitHub (floppywiggler/directio64-disclosure) substantially elevates practical risk beyond what the CVSS score alone communicates - an attacker with even a guest or standard Windows user session can immediately escalate capabilities to kernel-level hardware operations. This vulnerability is particularly relevant in post-compromise scenarios, where it enables privilege escalation without triggering common userspace security controls. It is also relevant to shared Windows environments such as lab workstations, SOC analyst machines running OSForensics, or QA/testing systems running BurnInTest. Even a mid-sized municipal IT team in malbork running PassMark diagnostics on shared hardware would face real risk of complete host compromise if an attacker gains initial foothold via phishing or lateral movement. There is no CISA KEV listing at time of analysis, so confirmed active exploitation in the wild has not been established, but the PoC lowers the bar significantly. Patches are available, making the residual risk primarily a function of patch deployment speed.

An attacker who has obtained a standard Windows user account - via phishing, credential stuffing, or lateral movement - on a workstation running PassMark PerformanceTest or OSForensics opens a handle to the DirectIo64 device object using the permissive default ACL. The attacker then dispatches IOCTLs corresponding to privileged hardware operations such as reading or writing model-specific registers (MSRs), directly accessing physical memory, or manipulating PCI configuration space, achieving kernel-level hardware control without requiring administrator credentials. A public PoC repository (github.com/floppywiggler/directio64-disclosure) documents the specific IOCTL codes and expected behavior, making this scenario trivially reproducible.