CVE-2026-80112: Incorrect Permission Assignment for Critical Resource in PassMark Software PerformanceTest

PassMark Software PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver. The device object created by this driver lacks a security descriptor, resulting in a permissive default Windows ACL that allows unprivileged local users to open a handle and issue IOCTL commands to perform privileged hardware operations regardless of their privilege or integrity level.

Unprivileged local users can exploit this vulnerability to perform privileged hardware operations by accessing the device object without proper permission checks. This can lead to unauthorized hardware access and potentially compromise system integrity. The CVSS v4.0 score of 8.5 indicates a high severity impact with local attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or vendor advisory content is provided in the input data. Until a fix is available, restrict local user access to affected systems and monitor for suspicious local activity involving device handles. Avoid running untrusted code with local user privileges on affected versions.