CVE-2026-80117 is a high severity (CVSS 7.1) privilege escalation flaw in the DirectIo64.sys driver shipped with PassMark PerformanceTest, BurnInTest and OSForensics. Local users can issue arbitrary IN and OUT instructions to any x86 I/O port because no allowlist exists. Update to the fixed builds named below.
What's affected
- PassMark PerformanceTest before 11.1 build 1012.
- PassMark BurnInTest before 11.1 build 1000.
- PassMark OSForensics before 11.1 build 1016.
- Build numbers do not map cleanly to driver files, so compare file hashes with those in the researcher write-up.
Record severity: CVSS 7.1 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. The weakness class is CWE-782, Exposed IOCTL with Insufficient Access Control.
How to check if you're exposed
Find DirectIo64.sys on each Windows host that has a PassMark product, and compute its hash with Get-FileHash. Compare it with the list in the researcher write-up. Also confirm the product build number in the About dialog.
What to do now
- Make a list of hosts with PassMark tools, including lab and forensic machines.
- Update each tool to the fixed build or newer.
- Remove old copies of the driver file.
- Restrict who can log in to lab and test hosts.
- Add the old driver hash to your endpoint detection watch list if your tooling supports it.
Why it matters
The record classes this under CWE-782, exposed IOCTL with insufficient access control. The driver accepts requests that read and write the full range of I/O ports and does not filter them. The CPU normally limits those instructions to trusted code, and the driver hands that power to any caller.
This is one of several related driver issues described in the write-up, which also notes that the flawed binary stays useful to attackers after the vendor fix. That makes cleaning up old copies as important as updating the product. The record does not mark the CVE as exploited in the wild.
Quick check
Why do old driver copies matter?
The write-up explains that the old signed binary can still be loaded by someone with admin rights, so remove it.
Is this remote?
No, it needs local access.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
