Which versions of FluxInk Color Driver are affected by CVE-2026-58583?

Lenovo endpoints using the FluxInk Color Management Driver contain a local privilege escalation flaw allowing standard users to gain kernel-level control.. A patch is available.

Is there a public PoC exploit available for CVE-2026-58583?

Yes, a public proof-of-concept exploit is available for CVE-2026-58583. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-58583?

Within 24 hours: Scan environment for Lenovo systems with TcnPeripheral64.sys version 1.0.7.2 and document affected asset inventory. Within 7 days: Complete testing of FluxInk Color Management Driver version 1.0.7.6 in a representative test environment. Within 30 days: Deploy version 1.0.7.6 across all affected Lenovo systems and verify successful patch installation.

FluxInk Color Driver CVE-2026-58583

Q: What is the CVSS score of CVE-2026-58583?

CVE-2026-58583 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42094 HIGH

Improper Privilege Management (CWE-269)

2026-07-07 cisa-cg

GHSA-g73c-jxmq-7fh5

Privilege Escalation Lenovo Microsoft Color Management Driver

8.4

CVSS 4.0 · Vendor: cisa-cg

Severity by source

Vendor (cisa-cg) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Local standard-user access (AV:L, PR:L) reliably yields arbitrary physical-memory read/write across the kernel boundary (S:C), giving full C/I/A including crash-induced availability loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:26 vuln.today

CVSS changed

Jul 07, 2026 - 21:22 NVD

7.1 (HIGH) 8.4 (HIGH)

CVE Published

Jul 07, 2026 - 20:33 cve.org

HIGH 8.4

DescriptionCVE.org

FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privilege escalation for a standard user account via arbitrary physical memory mapping at \Device\PhysicalMemory. Fixed in version 1.0.7.6. The fixed driver is currently available in the Windows 11 25H2 HLK (Hardware Lab Kit). The fixed driver may be available through Windows Update or from Lenovo directly.

AnalysisAI

Local privilege escalation in the FluxInk (formerly Sunia SPB Peripheral) Color Management Driver TcnPeripheral64.sys version 1.0.7.2 lets a standard user map arbitrary physical memory via the \Device\PhysicalMemory object and gain kernel-level control. The flaw affects Lenovo systems shipping this signed color-management driver and is fixed in version 1.0.7.6. Publicly available exploit code exists; there is no public exploit identified as actively exploited (not in CISA KEV), though the vulnerability was reported by CISA (cisa-cg).

Technical ContextAI

The vulnerable component is a Windows kernel-mode driver (TcnPeripheral64.sys) used for color management on peripheral/display hardware, historically branded Sunia SPB Peripheral and now FluxInk. The root cause maps to CWE-269 (Improper Privilege Management): the driver exposes a device interface that permits an unprivileged caller to create a mapping to \Device\PhysicalMemory, the NT object representing all system physical RAM. Because kernel drivers run in ring 0 and \Device\PhysicalMemory grants direct read/write to every physical page - including page tables, kernel structures, and token objects - a driver that fails to restrict access to this section object effectively hands ring-0 read/write primitives to any process that can open its device. This is a classic 'BYOVD-style' insecure driver primitive, except here the vulnerable driver is legitimately installed on the target rather than dropped by the attacker.

RemediationAI

Vendor-released patch: 1.0.7.6 - upgrade the FluxInk/Sunia Color Management Driver to version 1.0.7.6, which the advisory states is available in the Windows 11 25H2 HLK (Hardware Lab Kit) and may be delivered via Windows Update or directly from Lenovo. Where the patched driver cannot be deployed immediately, the most effective compensating control is to block-list or remove the vulnerable TcnPeripheral64.sys 1.0.7.2 using Microsoft's vulnerable driver blocklist / WDAC (Windows Defender Application Control) or HVCI, accepting that this disables color-management functionality for the affected peripheral until the fix is applied. Restricting local logon on high-value hosts and monitoring for processes opening the driver's device object are additional interim measures. Consult the CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-188-01.json and the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-58583 for authoritative fix details.