Unauthenticated Physical Memory Disclosure in PassMark PerformanceTest, BurnInTest, and OSForensics
CVE-2026-80118

8.4HIGH

Key Information:

Vendor

Passmark Software

Status
Performancetest
Burnintest
Osforensics
Vendor
CVE Published:
4 September 2026

Badges

👾 Exploit Exists

What is CVE-2026-80118?

The vulnerability in DirectIo64.sys allows unprivileged local users to exploit a single IOCTL without caller-identity checks, leading to the unauthorized disclosure of physical memory. This flaw enables attackers to write crash dump images to arbitrary file paths, revealing sensitive information such as the kernel module list and active process details. Furthermore, the vulnerability can cause kernel crashes due to improper handling of returned NULL values in specific failure paths.

Affected Version(s)

BurnInTest 0

OSForensics 0

PerformanceTest 0

References

https://github.com/floppywiggler/directio64-disclosure
technical-descriptionexploit
https://www.passmark.com/products/performancetest/history...
release-notespatch
https://www.passmark.com/products/burnintest/history.php
release-notespatch

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Emil Sørbrøden
.