Lenovo Power Management Driver CVE-2025-9548

Requires a local, authenticated low-privilege session on a Lenovo device that has the Lenovo Power Management Driver installed (AV:L/PR:L); the attacker must be able to interact with the driver locally. Limiting factors: no remote vector, no exploitation without an existing account on the host, and the outcome is confined to a crash/reboot of that single machine - there is no privilege gain, persistence, or cross-system effect. Exposure is scoped to Windows systems running the affected Lenovo driver, so non-Lenovo hosts and systems without this driver are unaffected.

This is a genuine but low-priority issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and the description agree cleanly: exploitation requires local access and an existing authenticated (low-privilege) session on the machine, with no user interaction. The sole impact is availability (VA:H) - a Windows blue-screen crash (denial of service) - with no confidentiality or integrity impact (VC:N/VI:N), consistent with the CWE-476 null pointer dereference. All signals point the same way: the 6.8 (medium) score is driven entirely by the availability impact, not by remote reach or code execution. EPSS is very low at 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code is identified, so there is no evidence of exploitation pressure. The signals are internally consistent - no contradictions between CVSS, description, and threat intel. The practical ceiling of harm is a local attacker (or malware already running under a user account) crashing the host; it cannot be used for privilege escalation, data theft, or remote compromise. This is a patch-in-normal-cycle item, not an emergency.

A local authenticated user, or malware already executing under a standard user account on a Lenovo device, issues a crafted request to the Lenovo Power Management Driver that triggers the null pointer dereference, causing an immediate Windows blue-screen crash and rebooting the machine. No public exploit code is identified at time of analysis, and the attack yields only disruption - no code execution or data access.