CVE-2026-80119

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a caller-controlled file path to an exposed IOCTL. Attackers can issue a single IOCTL call to trigger the driver to iterate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a full RAM image to an attacker-specified path in the SYSTEM context, bypassing user-mode ACLs and exposing LSASS working set, process memory, and cryptographic material from all running processes.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://dkom.dev/posts/directio64-disclosure/
https://github.com/floppywiggler/directio64-disclosure
https://www.osforensics.com/whats-new.html
https://www.passmark.com/products/burnintest/history.php
https://www.passmark.com/products/performancetest/history.php
https://www.vulncheck.com/advisories/passmark-performancetest-burnintest-and-osforensics-physical-memory-disclosure-via-directio64-sys-ioctl

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-04 19:17

Updated : 2026-09-08 20:10

NVD link : CVE-2026-80119

Mitre link : CVE-2026-80119

CVE.ORG link : CVE-2026-80119

JSON object : View

Products Affected

No product.

CWE

CWE-73

External Control of File Name or Path

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

{"id": "CVE-2026-80119", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-80119", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-04T19:19:47.375349Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "PassMark Software", "product": "PerformanceTest", "versions": [{"status": "affected", "version": "0", "lessThan": "11.1 build 1012", "versionType": "custom"}], "defaultStatus": "affected"}, {"vendor": "PassMark Software", "product": "BurnInTest", "versions": [{"status": "affected", "version": "0", "lessThan": "11.1 build 1000", "versionType": "custom"}], "defaultStatus": "affected"}, {"vendor": "PassMark Software", "product": "OSForensics", "versions": [{"status": "affected", "version": "0", "lessThan": "11.1 build 1016", "versionType": "custom"}], "defaultStatus": "affected"}]}], "published": "2026-09-04T19:17:28.857", "references": [{"url": "https://dkom.dev/posts/directio64-disclosure/", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/floppywiggler/directio64-disclosure", "source": "disclosure@vulncheck.com"}, {"url": "https://www.osforensics.com/whats-new.html", "source": "disclosure@vulncheck.com"}, {"url": "https://www.passmark.com/products/burnintest/history.php", "source": "disclosure@vulncheck.com"}, {"url": "https://www.passmark.com/products/performancetest/history.php", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/passmark-performancetest-burnintest-and-osforensics-physical-memory-disclosure-via-directio64-sys-ioctl", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-497"}]}], "descriptions": [{"lang": "en", "value": "PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a caller-controlled file path to an exposed IOCTL. Attackers can issue a single IOCTL call to trigger the driver to iterate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a full RAM image to an attacker-specified path in the SYSTEM context, bypassing user-mode ACLs and exposing LSASS working set, process memory, and cryptographic material from all running processes."}], "lastModified": "2026-09-08T20:10:30.270", "sourceIdentifier": "disclosure@vulncheck.com"}