Executive brief
A vulnerability in a color management driver used in certain Lenovo devices allows a standard user to gain full administrative control over a Windows computer. By exploiting this flaw, an attacker who already has limited access to a system can bypass security boundaries to steal data, disable security software, or install persistent malware. The issue has been addressed in newer versions of the driver available through Windows Update and hardware manufacturer support.
Technical details
The FluxInk (formerly Sunia SPB Peripheral) Color Management Driver, TcnPeripheral64.sys version 1.0.7.2, contains a vulnerability in its IOCTL handler (specifically IOCTL 0x4002848). The driver fails to validate user-supplied physical addresses and sizes before passing them to MmMapIoSpace or ZwMapViewOfSection. This allows an unprivileged local attacker to map arbitrary physical memory with Read/Write permissions. By locating and modifying kernel structures such as EPROCESS tokens in physical memory, an attacker can escalate privileges to NT AUTHORITY\SYSTEM. The vulnerability is fixed in version 1.0.7.6, which is distributed via the Windows 11 25H2 HLK and Lenovo support channels.
Affected products
- FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 and earlier
Timeline
- 2026-01-20: other: Exploit code authored by researcher
- 2026-02-24: disclosed: Initial GitHub security advisory published
- 2026-07-07: advisory: CVE-2026-58583 published to NVD