CVE-2026-58583
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The FluxInk Color Management Driver (TcnPeripheral64.sys) version 1.0.7.2 allows local privilege escalation for a standard user account via arbitrary physical memory mapping at \Device\PhysicalMemory. Fixed in version 1.0.7.6.
Risk Assessment
The organization faces the risk of system compromise by an unprivileged user, potentially leading to data theft, malware installation, or further attacks on the infrastructure.
Recommendation
Immediately update the TcnPeripheral64.sys driver to version 1.0.7.6, available via Windows Update or directly from Lenovo. If an update is not possible, consider temporarily disabling the driver.
Original NVD description (English source)
FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privilege escalation for a standard user account via arbitrary physical memory mapping at \Device\PhysicalMemory. Fixed in version 1.0.7.6. The fixed driver is currently available in the Windows 11 25H2 HLK (Hardware Lab Kit). The fixed driver may be available through Windows Update or from Lenovo directly.