EUVD-2026-102536
GHSA-c8h9-9gfr-9r8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local authenticated access
-
ExploitSend malformed IOCTL to Energy Management driver
-
ExecutionTrigger out-of-bounds write in kernel memory
-
ImpactCorrupt kernel structures causing BSOD
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Lenovo Energy Management driver to be installed and loaded on the target system (a Windows kernel-mode driver, per the blue-screen impact), and the attacker must already hold a local authenticated session on that host (PR:L). Exploitation is limited by the need for local access - there is no network vector - and by the impact ceiling: it causes a kernel crash/DoS only, with no path to code execution or data disclosure in the vendor description. Systems without this specific driver installed are not affected. |
| Impact | This is a moderate-severity, availability-only issue, not a high-priority emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms exploitation requires LOCAL access and LOW privileges (an authenticated user already on the machine), with impact limited to availability (VA:H; VC:N/VI:N/VA:H), i.e. a denial-of-service crash rather than code execution or data compromise. Despite the CWE-787 out-of-bounds write classification - a class often associated with RCE - the vendor explicitly scopes the consequence to a blue screen (BSOD/local DoS), so there is no confirmed confidentiality or integrity impact in the available data. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of local-only vector, required authentication, and DoS-only impact means this ranks well below internet-facing or RCE-class flaws; it is a 'high-CWE-but-contained-impact' issue. Note a limitation: no SSVC decision data or EPSS value was supplied, so automatability and real-world exploitation likelihood cannot be quantified from the input. |
| Exploit ScenarioDerived | A local authenticated user (or malware already running under a standard user account) on a Lenovo system with the Energy Management driver installed sends a crafted request to the vulnerable kernel driver, triggering an out-of-bounds write that corrupts kernel memory and crashes the machine into a blue screen. No public proof-of-concept was identified. The attack is confined to the local host and yields only denial of service, not privilege escalation or data theft per the vendor description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
An out-of-bounds write in the Lenovo Energy Management kernel-mode driver lets a local authenticated user crash the affected Windows host with a blue-screen (kernel bugcheck) error, producing a denial-of-service condition on systems where the driver is installed and loaded. The flaw is availability-only: the assessed impact is kernel memory corruption leading to a crash, with no demonstrated path to code execution or data disclosure, and it requires the attacker to already hold a local session on the machine (PR:L) - there is no network-reachable attack surface. No public exploit code and no evidence of active exploitation were identified at time of analysis, so this should be treated as a moderate-severity, patch-and-move-on item rather than an emergency; the vendor advisory is Lenovo LEN-218444.
RemediationAI
No vendor-released patch version is identified in the available data, so the first action is to retrieve the current fix status, affected model list, and any driver update from the Lenovo advisory LEN-218444 at https://support.lenovo.com/us/en/product_security/LEN-218444, and apply the updated driver package through Lenovo Vantage, Lenovo System Update, or the product support page as soon as Lenovo publishes it; because this is a kernel-mode driver, the update must be installed with administrative rights and typically requires a reboot before the vulnerable code is unloaded. Where the Energy Management functionality is not required on a given host, the driver can be removed or disabled (for example by disabling the corresponding device/driver in Device Manager or removing the driver package, then rebooting) - the trade-off is loss of Lenovo battery/energy-management features and possible loss of related power-tuning behavior on that machine. Reducing the local attack surface is the most effective compensating control: because the vector requires an existing low-privileged local session (PR:L), restrict interactive logon and local user accounts on affected endpoints to trusted personnel and remove unnecessary standard accounts, accepting that this does not protect against an already-compromised account. Kernel crash telemetry (unexpected blue-screen/bugcheck events, especially correlated with processes issuing device IOCTLs to the Lenovo Energy Management driver) should be monitored as a detection signal, and no network-side mitigation exists because the vector is strictly local.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a Windows kernel-mode driver shipped by Lenovo as part of its Energy Management software stack (tracked as cpe:2.3:a:lenovo:energy_management_driver, with a wildcard version indicating the affected range is enumerated in the vendor advisory rather than the CPE). The root cause class is CWE-787, out-of-bounds write: kernel drivers of this type expose IOCTL/device interfaces to user-mode callers, and a missing or insufficient bounds check on a caller-supplied length or buffer size allows data to be written past the end of a kernel-allocated buffer. Because the corruption occurs in kernel memory (typically pool), the immediate consequence is memory corruption that drives the operating system into a bugcheck - the blue-screen error described by the vendor. The CVSS 4.0 vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N and our assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H agree on the important properties: local attack vector, low attack complexity, low privileges required (an ordinary authenticated local user), no user interaction, and high availability impact only - confidentiality and integrity are unaffected, and there is no scope change, meaning no pivot to other components is implied by the available data. Only hosts with this specific driver installed and loaded are exposed.
Know when Energy Management Driver gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local authenticated user (AV:L, PR:L), no interaction, and impact is a kernel crash so availability-only (A:H) with no confidentiality or integrity effect.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
1DescriptionCVE.org
A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB