Improper Access Control in PassMark's PerformanceTest, BurnInTest, and OSForensics
CVE-2026-80112

8.5HIGH

Key Information:

Vendor

Passmark Software

Status
Performancetest
Burnintest
Osforensics
Vendor
CVE Published:
4 September 2026

Badges

👾 Exploit Exists

What is CVE-2026-80112?

The PassMark PerformanceTest, BurnInTest, and OSForensics software are affected by an improper access control vulnerability in the DirectIo64.sys kernel driver. This vulnerability allows unprivileged local users to perform privileged hardware operations by gaining unauthorized access to device objects lacking proper security descriptors. The underlying issue stems from the permissive default Windows ACL applied to the device, which can be exploited by attackers to issue IOCTLs and access restricted hardware functions, undermining system integrity and confidentiality.

Affected Version(s)

BurnInTest 0

OSForensics 0

PerformanceTest 0

References

https://github.com/floppywiggler/directio64-disclosure
technical-descriptionexploit
https://www.passmark.com/products/performancetest/history...
release-notespatch
https://www.passmark.com/products/burnintest/history.php
release-notespatch

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Emil Sørbrøden
.