CVE-2026-80113

The record

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to clear arbitrary bits at any physical memory address due to missing validation of the physical address parameter in an exposed IOCTL handler. Attackers can obtain a device handle and supply an arbitrary 64-bit physical address with a bit index to invoke MmMapIoSpace and clear bits in kernel code pages or page table entries, enabling local privilege escalation or system compromise.

Affected packages

Related vulnerabilities

• CVE-2026-80116 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and… CWE-782
• CVE-2026-80117 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and… CWE-782
• CVE-2026-57851 MSI Feature Manager contains a local privilege escalation vulnerability in the… CWE-782
• CVE-2026-8797 An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows. CWE-782
• CVE-2026-56129 Generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook… CWE-782
• CVE-2026-8501 Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet… CWE-782
• CVE-2026-6737 An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a… CWE-782
• CVE-2026-36355 The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions… CWE-782