CVE-2026-80115: medium-severity vulnerability in PassMark Software PerformanceTest
PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Crash via DirectIo64.sys MSR Write IOCTL
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.2%
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation and denial-of-service vulnerability in DirectIo64.sys that allows local attackers to read arbitrary Model-Specific Registers or write zero to any MSR through exposed IOCTLs with insufficient blocklist enforcement. Attackers can exploit the unrestricted write IOCTL to zero out the system call handler MSR, causing an immediate unrecoverable kernel crash on the next system call, or read security-sensitive MSRs used to locate kernel data structures.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
PassMark Software · BurnInTestPassMark Software · OSForensicsPassMark Software · PerformanceTestpublic PoCs found — 1
cve_referencegithub.com/floppywiggler/directio64-disclosureunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — PassMark Software PerformanceTest
In the same product, most dangerous first.
CVE-2026-80114HIGHPassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sysEPSS 0.2%CVE-2026-80119HIGHPassMark PerformanceTest, BurnInTest, and OSForensics Physical Memory Disclosure via DirectIo64.sys IOCTLEPSS 0.2%CVE-2026-80116HIGHPassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTLEPSS 0.2%CVE-2026-80118HIGHPassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTLEPSS 0.2%CVE-2026-80117MEDIUMPassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary I/O Port Access via DirectIo64.sysEPSS 0.2%CVE-2026-80113MEDIUMPassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary Bit Clear via DirectIo64.sys IOCTLEPSS 0.2%
References
https://dkom.dev/posts/directio64-disclosure/https://github.com/floppywiggler/directio64-disclosurehttps://www.osforensics.com/whats-new.htmlhttps://www.passmark.com/products/burnintest/history.phphttps://www.passmark.com/products/performancetest/history.phphttps://www.vulncheck.com/advisories/passmark-performancetest-burnintest-and-osforensics-kernel-crash-via-directio64-sys-msr-write-ioctl