CVE-2026-80118
Received Received - Intake

Unauthenticated Physical Memory Disclosure in PassMark Tools

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disclosure in DirectIo64.sys, reachable by unprivileged local users through a single IOCTL with no caller-identity check. The handler writes a crash-dump-format (PAGEDU64) image of all physical memory to a caller-supplied file path in the SYSTEM context, allowing a standard user to create files in locations they cannot otherwise write and to recover memory belonging to processes of other users. The image is preceded by a header that exposes the kernel loaded-module list, active-process list and PFN database pointers, defeating KASLR. The same handler also dereferences the return value of an internal kernel-structure locator without a NULL check; that locator returns NULL on three distinct failure paths, and a kernel crash results on builds where any of those paths is taken.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80118
EUVD
EUVD-2026-71689

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
passmark performancetest to 11.1_build_1012 (exc)
passmark burnintest to 11.1_build_1000 (exc)
passmark osforensics to 11.1_build_1016 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016. It allows unauthenticated local users to access physical memory through a vulnerable driver (DirectIo64.sys). The flaw permits unprivileged users to read memory contents of other processes and write files in restricted locations by exploiting an IOCTL call without proper caller checks.

Detection Guidance

This vulnerability is specific to PassMark PerformanceTest, BurnInTest, and OSForensics versions before 11.1 build 1012, 11.1 build 1000, and 11.1 build 1016 respectively. Check installed versions of these software on your system. Look for unexpected crash-dump files in locations where standard users should not have write access, as these may indicate exploitation.

Impact Analysis

An attacker with local access could exploit this to read sensitive data from other users' processes, bypass security controls, or crash the system. They could also write files in restricted directories, potentially leading to privilege escalation or further system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It undermines data protection measures and may result in non-compliance due to potential exposure of personal or health information.

Mitigation Strategies

Update PassMark PerformanceTest to version 11.1 build 1012 or later, BurnInTest to version 11.1 build 1000 or later, and OSForensics to version 11.1 build 1016 or later. Remove or disable these applications if not required. Monitor system logs for unusual file creation or memory dump activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80118. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart