Read the docs
TI-2026-55376 Aliases CVE-2026-80119GHSA-gqcv-f465-78vf

PassMark PerformanceTest, BurnInTest, and OSForensics Physical Memory Disclosure via DirectIo64.sys IOCTL

Priority HIGH 72CWE-497Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-497.

Summary

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a caller-controlled file path to an exposed IOCTL. Attackers can issue a single IOCTL call to trigger the driver to iterate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a full RAM image to an attacker-specified path in the SYSTEM context, bypassing user-mode ACLs and exposing LSASS working set, process memory, and cryptographic material from all running processes.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00184 7th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed PerformanceTest (PassMark Software): 11.1 build 1012BurnInTest (PassMark Software): 11.1 build 1000+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PassMark SoftwarePerformanceTestbefore 11.1 build 101211.1 build 1012Patch availableCNA
PassMark SoftwareBurnInTestbefore 11.1 build 100011.1 build 1000Patch availableCNA
PassMark SoftwareOSForensicsbefore 11.1 build 101611.1 build 1016Patch availableCNA
  • PerformanceTest VendorPassMark Software Affected before 11.1 build 1012 Fixed in 11.1 build 1012 Patch available CNA
  • BurnInTest VendorPassMark Software Affected before 11.1 build 1000 Fixed in 11.1 build 1000 Patch available CNA
  • OSForensics VendorPassMark Software Affected before 11.1 build 1016 Fixed in 11.1 build 1016 Patch available CNA

Remediation

  • Fix · CNA PerformanceTest (PassMark Software) Fixed in 11.1 build 1012
  • Fix · CNA BurnInTest (PassMark Software) Fixed in 11.1 build 1000
  • Fix · CNA OSForensics (PassMark Software) Fixed in 11.1 build 1016

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PassMark Software BurnInTest, OSForensics, PerformanceTest 11.1 build 1000, 11.1 build 1012, 11.1 build 1016

    8 records Highest priority Priority HIGH 4 HIGH, 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-55375 PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTLPriority HIGH 72
    • TI-2026-55373 PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTLPriority HIGH 72
    • TI-2026-55371 PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sysPriority HIGH 72
    Show all 8 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-80119
  2. 2026-10-03 Alias added: GHSA-gqcv-f465-78vf

References

Exploit 1

Patch 3

Other 1

  • TI-2026-55375 PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTL CVSS 4.0HIGH 8.4
  • TI-2026-55373 PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTL CVSS 4.0HIGH 8.5
  • TI-2026-55371 PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sys CVSS 4.0HIGH 8.5
  • TI-2026-55370 PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary Bit Clear via DirectIo64.sys IOCTL CVSS 4.0MEDIUM 6.9
  • TI-2026-55369 PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys CVSS 4.0HIGH 8.5
  • TI-2026-55374 PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary I/O Port Access via DirectIo64.sys CVSS 4.0MEDIUM 6.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences