PassMark PerformanceTest EUVD-2026-71685

The three PassMark products (PerformanceTest, BurnInTest, or OSForensics) must be installed on the Windows host, which causes DirectIo64.sys to be present on the system. The attacker requires a local user account (PR:L) - no administrative privileges are needed to open the driver and send IOCTLs assuming default device object permissions on the vulnerable builds. No specific non-default configuration is required beyond software installation; the vulnerability exists in the default shipped state of the driver. Exploitation is limited to Windows (kernel driver .sys); the attack cannot be performed remotely or without at least local interactive or remote-desktop-equivalent session access. Version constraint: builds at or above PerformanceTest 11.1 build 1012, BurnInTest 11.1 build 1000, and OSForensics 11.1 build 1016 contain the vendor-released fix.

The CVSS 4.0 score of 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately captures the severity: low-privilege local access plus trivial exploitation complexity is sufficient to achieve full physical memory control. Arbitrary physical memory writes on Windows translate directly to kernel-level code execution - overwriting kernel data structures, injecting shellcode into kernel space, or disabling security products. This is effectively a local privilege escalation to SYSTEM and beyond. A publicly available PoC on GitHub lowers the exploitation barrier substantially; a skilled attacker could weaponize this within hours of reading the disclosure. The EPSS score is not provided in the input data, but given the PoC availability and the clear technical primitives, even a mid-sized municipal IT team in olsztyn should treat this as urgent if any of the three PassMark products are deployed on Windows endpoints or workstations with shared or untrusted user access. The CVSS scope metrics (SC:N/SI:N/SA:N in the provided 4.0 vector) arguably understate the real-world blast radius: arbitrary physical memory writes inherently compromise the host OS kernel, not just the PassMark application - a limitation worth noting when comparing against the provided vector. No KEV listing exists, so confirmed active exploitation is not established, but the PoC materially elevates real-world risk above what base CVSS alone communicates.

A threat actor with a standard local user account on a Windows host where any of the three PassMark products are installed downloads the published PoC from https://github.com/floppywiggler/directio64-disclosure. The attacker runs the tool, which extracts the hardcoded 8-byte key from DirectIo64.sys, computes a valid MD5 authentication tag, then sends a single bit-clear IOCTL to permanently disable all driver-side validation. The attacker then issues unrestricted physical memory write IOCTLs to overwrite kernel code or data structures, achieving kernel-level code execution and full system compromise.