Skip to content
OpenAdvisories
High · 7.1 CVE-2026-80117 EUVD-2026-71688GHSA-p6jp-vch5-mc54

PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary I/O Port Access via DirectIo64.sys

Published Sep 4, 2026 · Updated Oct 1, 2026 · Assigned by VulnCheck

Description

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to issue arbitrary IN and OUT instructions to any x86 I/O port due to missing allowlist or port validation on exposed IOCTLs. Attackers can obtain a device handle and write to sensitive ports including the PS/2 controller port, CPU reset ports, CMOS configuration ports, and interrupt controller ports to cause an immediate system reset or other hardware-level manipulation from a standard user account.

Affected products

VendorProductAffectedFixed
PassMark Software PerformanceTest < 11.1 build 1012 11.1 build 1012
PassMark Software BurnInTest < 11.1 build 1000 11.1 build 1000
PassMark Software OSForensics < 11.1 build 1016 11.1 build 1016

References