anonhaven

CVE-2026-80119

HIGH CVSS 4.0: 8.5 EPSS 0.12%
Updated Sep 08, 2026
PassMark
Parameter Value
CVSS 8.5 (HIGH)
Affected Versions before 11.1
Type CWE-73 (External Control of File Name or Path), CWE-497
Vendor PassMark
Public PoC No

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a caller-controlled file path to an exposed IOCTL. Attackers can issue a single IOCTL call to trigger the driver to iterate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a full RAM image to an attacker-specified path in the SYSTEM context, bypassing user-mode ACLs and exposing LSASS working set, process memory, and cryptographic material from all running processes.

Attack Parameters

Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service

CVSS Vector v4.0

Weakness Type (CWE)

CWE-73 External Control of File Name or Path
CWE-497

References 6

https://dkom.dev/posts/directio64-disclosure/
disclosure@vulncheck.com
https://github.com/floppywiggler/directio64-disclosure
disclosure@vulncheck.com
https://www.osforensics.com/whats-new.html
disclosure@vulncheck.com
https://www.passmark.com/products/burnintest/history.php
disclosure@vulncheck.com
https://www.passmark.com/products/performancetest/history.php
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/passmark-performancetest-burnintest-and-os…
disclosure@vulncheck.com
Share Post Share Share Share