FluxInk Color Driver EUVD-2026-42094

Requires local code execution as an authenticated standard user (CVSS PR:L) on a system where the FluxInk/Sunia Color Management Driver TcnPeripheral64.sys version 1.0.7.2 is installed and its device object is accessible. The specific enabling condition is the driver's failure to restrict a standard user from creating a mapping to the \Device\PhysicalMemory section object; no privileged account, no user interaction, and no non-default configuration are needed beyond the presence of the vulnerable driver. The principal limiting factors are: the attacker must already have a local account/session on the box (no remote vector - AV:L), and the vulnerable driver must actually be installed, which restricts exposure to the specific (largely Lenovo) hardware/software builds that ship this color-management driver.

This is a genuine, high-priority local escalation on affected hosts. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N, base 8.4) confirms local access with low complexity and only standard-user privileges required, no user interaction - a reliable, deterministic escalation rather than a race or heap-grooming gamble. Public POC code from researcher b3s3da lowers the exploitation barrier substantially. No EPSS score was provided, and the CVE is not listed in CISA KEV, so there is no evidence of active mass exploitation; the realistic risk profile is that of a strong post-compromise/local-attacker tool (malware SYSTEM escalation, insider abuse) rather than a remotely wormable threat. The main mitigating factor is that this driver is only present on the subset of (largely Lenovo) systems that install the FluxInk/Sunia color-management stack, bounding real-world exposure. One caveat: the vendor vector sets VA:N (no availability impact), but arbitrary physical-memory write realistically permits system crashes, so the true availability impact is likely understated.

A standard user (or malware already running as an unprivileged user) opens the TcnPeripheral64.sys device interface and requests a mapping of \Device\PhysicalMemory, then uses the resulting arbitrary read/write over physical RAM to patch its own process token or kernel structures and become SYSTEM. Public POC code (github.com/b3s3da/TcnPeripheral64_PoC) demonstrates the primitive, making weaponization straightforward. Because AC:L and PR:L, the attack is reliable and requires no user interaction beyond the attacker's own code.