The vulnerability is a kernel-mode flaw in DirectIo64.sys that is triggered by an unauthenticated IOCTL. The driver writes a crash‑dump image of all physical memory to a caller‑supplied file path, and the IOCTL performs no identity check, allowing any local user to invoke it. The resulting dump contains the entire physical memory, exposing credentials, secrets, and memory belonging to other processes, thereby compromising confidentiality. Additionally, the same handler dereferences a returned pointer without null checking, so when the pointer is null on any of three failure paths the kernel crashes, creating a denial‑of‑service condition. This flaw embodies CWE‑476 (Null Pointer Dereference), CWE‑497 (Privilege Escalation via Unprotected API), and CWE‑73 (Path Traversal).

The flaw affects PassMark Software’s BurnInTest (any build older than 11.1 build 1000), OSForensics (any build older than 11.1 build 1016), and PerformanceTest (any build older than 11.1 build 1012). Users running these legacy versions on Windows systems can exploit the DirectIo64.sys driver irrespective of user privileges.

With a CVSS score of 8.4, the vulnerability is deemed high severity; the EPSS score is not available and the issue is not yet listed in CISA’s KEV catalog. Attackers can exploit the flaw locally by invoking the vulnerable IOCTL with a crafted file path: the kernel writes the entire physical memory dump to the specified location in SYSTEM context, granting unprivileged users access to protected files and data otherwise out of reach. Failure paths in the driver also allow a kernel crash, which can be used for denial of service. Because the IOCTL lacks any caller‑identity check, the attack does not require elevated privileges or authentication, making it a straightforward local privilege escalation and data exposure vector.