CVE-2026-80112 is a high severity (CVSS 7.8) improper access control flaw in the DirectIo64.sys kernel driver shipped with PassMark PerformanceTest, BurnInTest and OSForensics. Unprivileged local users can open the device and perform privileged hardware operations. Fixed in PerformanceTest 11.1 build 1012, BurnInTest 11.1 build 1000 and OSForensics 11.1 build 1016.
What's affected
- PassMark PerformanceTest before 11.1 build 1012.
- PassMark BurnInTest before 11.1 build 1000.
- PassMark OSForensics before 11.1 build 1016.
- These are product build numbers, not driver versions. The researcher write-up notes the three counters do not identify the driver file, so identify the driver by file hash, not by product number.
Record severity: CVSS 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-732, Incorrect Permission Assignment for Critical Resource.
How to check if you're exposed
On a Windows host, check the installed product build in the program About dialog, and look for the file DirectIo64.sys on disk in the product folder. The researcher write-up lists SHA-256 hashes of affected and fixed driver files, so compare your file hash with those. In PowerShell, Get-FileHash returns the SHA-256 of a file.
What to do now
- Inventory hosts running PerformanceTest, BurnInTest or OSForensics.
- Update each product to the fixed build or later.
- Search for stray copies of DirectIo64.sys, including in old install folders and tool kits.
- Compare driver hashes with the fixed hashes listed in the write-up.
- Where you do not need the tools, uninstall them and remove the driver.
Why it matters
A kernel driver that touches hardware must check who is calling it. The researcher write-up says this one created its device without a security descriptor, so any local user could open it. The record classes it as improper access control (CWE-732). The write-up also notes the driver is validly signed, which is why old copies attract people who abuse signed drivers.
This entry is one of a family of related weaknesses in the same driver, covering CVE-2026-80112 through CVE-2026-80119 in the write-up. Local access is needed, so this is a privilege escalation and endpoint hardening concern. The record does not mark the CVE as exploited in the wild.
Quick check
Does updating the product remove the old driver file?
Not necessarily. Check for remaining copies of the old DirectIo64.sys and compare file hashes.
Is a remote attack possible?
No. The issue needs a local user.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
