CVE-2026-80118: NULL Pointer Dereference in PassMark Software PerformanceTest

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a local privilege vulnerability in the DirectIo64.sys driver. An unprivileged local user can invoke a single IOCTL without caller-identity checks to write a crash-dump-format image of all physical memory to a file path they specify, running in SYSTEM context. This allows unauthorized file creation in protected locations and memory disclosure of other users' processes. The memory image header exposes kernel module lists, active process lists, and PFN database pointers, effectively defeating KASLR protections. The same IOCTL handler also dereferences a kernel structure locator's return value without NULL checking, which can lead to a kernel crash if the locator returns NULL on any of three failure paths.

The vulnerability enables local unprivileged users to disclose the entire physical memory contents, including sensitive kernel and process information, and to create files in locations normally inaccessible to them. This compromises system confidentiality and integrity by exposing kernel data structures and defeating KASLR. The NULL pointer dereference can cause system instability or denial of service via kernel crashes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to affected systems and monitor for suspicious local activity involving the vulnerable IOCTL. Avoid running untrusted local code with any privileges.