CVE-2026-80118

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disclosure in DirectIo64.sys, reachable by unprivileged local users through a single IOCTL with no caller-identity check. The handler writes a crash-dump-format (PAGEDU64) image of all physical memory to a caller-supplied file path in the SYSTEM context, allowing a standard user to create files in locations they cannot otherwise write and to recover memory belonging to processes of other users. The image is preceded by a header that exposes the kernel loaded-module list, active-process list and PFN database pointers, defeating KASLR. The same handler also dereferences the return value of an internal kernel-structure locator without a NULL check; that locator returns NULL on three distinct failure paths, and a kernel crash results on builds where any of those paths is taken.

• CWE-73
• CWE-476
• CWE-497

• https://dkom.dev/posts/directio64-disclosure/
• https://github.com/floppywiggler/directio64-disclosure
• https://www.osforensics.com/whats-new.html
• https://www.passmark.com/products/burnintest/history.php
• https://www.passmark.com/products/performancetest/history.php
• https://www.vulncheck.com/advisories/passmark-performancetest-burnintest-and-osforensics-kernel-null-pointer-dereference-via-directio64-sys-ioctl

Published

Sep 4, 2026

Last Modified

Sep 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-80112PassMark PerformanceTest before 11.1 build 1012, BurnInTest …7.8
• CVE-2026-80113PassMark PerformanceTest before 11.1 build 1012, BurnInTest …7.1
• CVE-2026-80114PassMark PerformanceTest before 11.1 build 1012, BurnInTest …7.8
• CVE-2026-80115PassMark PerformanceTest before 11.1 build 1012, BurnInTest …6.1
• CVE-2026-80116PassMark PerformanceTest before 11.1 build 1012, BurnInTest …7.8
• CVE-2026-80117PassMark PerformanceTest before 11.1 build 1012, BurnInTest …7.1
• CVE-2026-80119PassMark PerformanceTest before 11.1 build 1012, BurnInTest …7.8
• CVE-2026-8012Inappropriate implementation in MHTML in Google Chrome prior…5.4
• CVE-2026-80125Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell…5.9
• CVE-2026-80126Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell…6.5
• CVE-2026-80127Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell…7.2
• CVE-2026-80128Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell…6.4