CVE-2026-58583: FluxInk Color Management Driver Local Privilege Escalation (CVSS 7.1)

Technical summary

CVE-2026-58583 is a privilege escalation vulnerability in the FluxInk (formerly Sunia SPB Peripheral) Color Management Driver affecting version 1.0.7.2. The vulnerability stems from improper access controls on the \Device\PhysicalMemory interface within TcnPeripheral64.sys. This kernel-mode driver component fails to enforce adequate privilege checks, allowing a local standard user to request arbitrary physical memory mappings. By gaining direct access to physical memory regions, an attacker can manipulate kernel structures, bypass security mechanisms, or inject malicious code into privileged contexts. The vulnerability is classified as CWE-269 (Improper Access Control).

Business impact

This vulnerability poses a significant local privilege escalation risk, particularly in environments where standard users have access to systems running the vulnerable FluxInk driver. Compromised machines could enable attackers to install persistent malware, exfiltrate sensitive data, or use the system as a pivot point for lateral movement. Organizations with shared workstations, classroom environments, or systems accessed by contractor/temporary staff should prioritize remediation. The attack requires only local access and no user interaction, making it suitable for both targeted attacks and opportunistic exploitation in multi-user settings.

Affected systems

The vulnerability affects FluxInk Color Management Driver version 1.0.7.2. This driver is commonly bundled with Lenovo systems and peripherals. Systems running Windows 10, Windows 11, and potentially earlier versions with the vulnerable driver installed are at risk. The fixed version 1.0.7.6 is currently available in the Windows 11 25H2 HLK and may be distributed through Windows Update or directly from Lenovo.

Exploitability

Exploitability is straightforward from a technical standpoint. The attack requires only local code execution in the context of a standard user account—no administrative rights, no special hardware, and no user interaction. Once a standard user gains code execution (via script, application, or lateral movement), the vulnerability becomes trivial to trigger. Proof-of-concept code would be elementary—essentially a request to map physical memory via the exposed device interface. This makes the vulnerability attractive for both targeted attacks and potential worm-like propagation in compromised environments.

Remediation

Organizations should update to FluxInk Color Management Driver version 1.0.7.6 or later. The fixed driver is available as part of Windows 11 25H2 HLK. Check with Lenovo for driver updates applicable to your specific hardware model and Windows version. For Windows 11 systems, enable Windows Update to receive the patched driver automatically. Verify successful remediation by confirming the driver version in Device Manager or via Windows Hardware Certification Kit (HCK) reporting.

Patch guidance

1. Identify affected systems: Inventory machines with the FluxInk Color Management Driver, version 1.0.7.2 or earlier. Check Device Manager under Graphics, Imaging, or Peripherals for 'FluxInk' or 'Sunia' references. 2. Obtain the patch: Download driver version 1.0.7.6 from Lenovo's support portal for your specific device model, or enable Windows Update on Windows 11 systems to receive the patched version automatically. 3. Deploy systematically: Prioritize user-facing workstations and shared systems first, then server environments running the driver. 4. Verify: After patching, confirm driver version via Device Manager properties or by querying TcnPeripheral64.sys file properties (Production Version should be 1.0.7.6+). 5. Roll back plan: If issues arise post-patch, retain the ability to revert to a working state, though this driver is typically not critical to OS functionality.

Detection guidance

Monitor for exploitation attempts targeting \Device\PhysicalMemory access patterns. On vulnerable systems, check logs for: (1) Process creation events from standard user accounts attempting to open or interact with kernel-mode device objects; (2) Driver load events—verify only legitimate versions are loaded; (3) Physical memory access requests from non-admin user processes. Verify currently loaded driver version using Get-WmiObject in PowerShell: 'Get-WmiObject Win32_SystemDriver | Where {$_.Name -like '*Tcn*'}' and cross-reference against version 1.0.7.6+. File integrity monitoring on TcnPeripheral64.sys can detect tampering or downgrade attempts.

Why prioritize this

This is a HIGH-severity vulnerability (CVSS 7.1) that combines local privilege escalation with straightforward exploitability. Unlike many local LPE flaws that require chaining with other vulnerabilities, this one is self-contained and accessible to any standard user with code execution. It poses a direct threat to endpoint security and is suitable for rapid exploitation in multi-user environments. Although not yet on the KEV list, the technical profile and Lenovo's prominence in enterprise and consumer markets warrant urgent attention. Patch deployment should commence within 1–2 weeks.

Risk score, explained

CVSS 3.1 score of 7.1 (HIGH) reflects: Attack Vector: Local (AV:L) — requires physical access or prior compromise to the machine. Attack Complexity: Low (AC:L) — the exploitation mechanism is straightforward. Privileges Required: Low (PR:L) — achievable by standard user accounts. User Interaction: None (UI:N) — no click-through needed. Scope: Unchanged (S:U) — impact remains within the affected system. Confidentiality: High (C:H) — attacker gains access to all kernel memory and sensitive data. Integrity: High (I:H) — attacker can modify kernel structures and system state. Availability: None (A:N) — the exploit does not directly crash or disable the system. The score appropriately reflects a significant but locally-scoped threat.

Frequently asked questions