CVE-2026-80115

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation and denial-of-service vulnerability in DirectIo64.sys that allows local attackers to read arbitrary Model-Specific Registers or write zero to any MSR through exposed IOCTLs with insufficient blocklist enforcement. Attackers can exploit the unrestricted write IOCTL to zero out the system call handler MSR, causing an immediate unrecoverable kernel crash on the next system call, or read security-sensitive MSRs used to locate kernel data structures.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://dkom.dev/posts/directio64-disclosure/
https://github.com/floppywiggler/directio64-disclosure
https://www.osforensics.com/whats-new.html
https://www.passmark.com/products/burnintest/history.php
https://www.passmark.com/products/performancetest/history.php
https://www.vulncheck.com/advisories/passmark-performancetest-burnintest-and-osforensics-kernel-crash-via-directio64-sys-msr-write-ioctl

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-04 19:17

Updated : 2026-09-14 20:16

NVD link : CVE-2026-80115

Mitre link : CVE-2026-80115

CVE.ORG link : CVE-2026-80115

JSON object : View

Products Affected

No product.

CWE

CWE-782

Exposed IOCTL with Insufficient Access Control

{"id": "CVE-2026-80115", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-80115", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-14T19:21:14.990848Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "PassMark Software", "product": "PerformanceTest", "versions": [{"status": "affected", "version": "0", "lessThan": "11.1 build 1012", "versionType": "custom"}], "defaultStatus": "affected"}, {"vendor": "PassMark Software", "product": "BurnInTest", "versions": [{"status": "affected", "version": "0", "lessThan": "11.1 build 1000", "versionType": "custom"}], "defaultStatus": "affected"}, {"vendor": "PassMark Software", "product": "OSForensics", "versions": [{"status": "affected", "version": "0", "lessThan": "11.1 build 1016", "versionType": "custom"}], "defaultStatus": "affected"}]}], "published": "2026-09-04T19:17:28.280", "references": [{"url": "https://dkom.dev/posts/directio64-disclosure/", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/floppywiggler/directio64-disclosure", "source": "disclosure@vulncheck.com"}, {"url": "https://www.osforensics.com/whats-new.html", "source": "disclosure@vulncheck.com"}, {"url": "https://www.passmark.com/products/burnintest/history.php", "source": "disclosure@vulncheck.com"}, {"url": "https://www.passmark.com/products/performancetest/history.php", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/passmark-performancetest-burnintest-and-osforensics-kernel-crash-via-directio64-sys-msr-write-ioctl", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-782"}]}], "descriptions": [{"lang": "en", "value": "PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation and denial-of-service vulnerability in DirectIo64.sys that allows local attackers to read arbitrary Model-Specific Registers or write zero to any MSR through exposed IOCTLs with insufficient blocklist enforcement. Attackers can exploit the unrestricted write IOCTL to zero out the system call handler MSR, causing an immediate unrecoverable kernel crash on the next system call, or read security-sensitive MSRs used to locate kernel data structures."}], "lastModified": "2026-09-14T20:16:53.780", "sourceIdentifier": "disclosure@vulncheck.com"}