EUVD-2026-71683
GHSA-p9w8-j39h-68rj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with low-privilege user required; scope changes to kernel via driver IOCTL abuse yielding full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening a handle to the device object created without a security descriptor. Attackers can issue IOCTLs through the permissive default Windows ACL applied to the device to access restricted hardware operations regardless of privilege or integrity level.
AnalysisAI
Unprivileged local users can issue privileged hardware IOCTLs through PassMark's DirectIo64.sys kernel driver across three PassMark products - PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) - because the driver's device object is created without a security descriptor, allowing Windows to apply a permissive default ACL. Any standard Windows user account can open a handle to the device and invoke kernel-level hardware operations regardless of their privilege or integrity level, effectively bypassing Windows privilege boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable PassMark product (PerformanceTest, BurnInTest, or OSForensics) must be installed on the target Windows system, which causes DirectIo64.sys to be loaded and its device object to be registered. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.5 with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H accurately reflects the threat profile: local access is required, but once achieved, exploitation is trivial and fully automated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade PassMark PerformanceTest to version 11.1 build 1012 or later, BurnInTest to 11.1 build 1000 or later, and OSForensics to 11.1 build 1016 or later using the vendor-provided patch history pages listed in the references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running PassMark PerformanceTest (versions before 11.1 build 1012), BurnInTest (versions before 11.1 build 1000), or OSForensics (versions before 11.1 build 1016) and confirm patch availability in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Burnintest
View allAn issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. Rat
An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. Rat
Arbitrary physical memory write via a hard-coded cryptographic key in the shared Windows kernel driver DirectIo64.sys af
Full physical memory disclosure in PassMark's shared kernel driver DirectIo64.sys affects PerformanceTest (before 11.1 b
Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012),
An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 B
Local privilege escalation to kernel in PassMark PerformanceTest, BurnInTest, and OSForensics allows a low-privileged lo
Privilege escalation and kernel DoS in PassMark's shared DirectIo64.sys kernel driver affect PerformanceTest (before 11.
Privilege escalation through the DirectIo64.sys kernel driver affects three PassMark products - PerformanceTest before b
Share
External POC / Exploit Code
Leaving vuln.today