CVE-2026-58583: CWE-269 Improper Privilege Management in FluxInk Color Management Driver
CVE-2026-58583 is a local privilege escalation vulnerability in the FluxInk Color Management Driver (TcnPeripheral64.sys) version 1.0.7.2. It allows a standard user to escalate privileges by mapping arbitrary physical memory via \Device\PhysicalMemory. The issue is fixed in version 1.0.7.6, which is included in the Windows 11 25H2 Hardware Lab Kit and may be available through Windows Update or directly from Lenovo.
AI Analysis
Technical Summary
The vulnerability in FluxInk Color Management Driver version 1.0.7.2 involves improper privilege management (CWE-269) that permits local users with standard privileges to escalate their rights by mapping arbitrary physical memory through the device interface \Device\PhysicalMemory. This can lead to full control over the affected system. The flaw is resolved in version 1.0.7.6, distributed via Windows 11 25H2 HLK and potentially through Windows Update or Lenovo's channels.
Potential Impact
Successful exploitation allows a local standard user to gain elevated privileges on the system, potentially leading to full system compromise. Confidentiality and integrity impacts are high, while availability is not affected. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available in FluxInk Color Management Driver version 1.0.7.6. This fixed version is included in the Windows 11 25H2 Hardware Lab Kit and may be distributed via Windows Update or Lenovo. Users and administrators should update to version 1.0.7.6 as soon as it becomes available through these channels to remediate this vulnerability.
CVE-2026-58583: CWE-269 Improper Privilege Management in FluxInk Color Management Driver
Description
CVE-2026-58583 is a local privilege escalation vulnerability in the FluxInk Color Management Driver (TcnPeripheral64.sys) version 1.0.7.2. It allows a standard user to escalate privileges by mapping arbitrary physical memory via \Device\PhysicalMemory. The issue is fixed in version 1.0.7.6, which is included in the Windows 11 25H2 Hardware Lab Kit and may be available through Windows Update or directly from Lenovo.
CVSS v3.1
Score 7.1high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in FluxInk Color Management Driver version 1.0.7.2 involves improper privilege management (CWE-269) that permits local users with standard privileges to escalate their rights by mapping arbitrary physical memory through the device interface \Device\PhysicalMemory. This can lead to full control over the affected system. The flaw is resolved in version 1.0.7.6, distributed via Windows 11 25H2 HLK and potentially through Windows Update or Lenovo's channels.
Potential Impact
Successful exploitation allows a local standard user to gain elevated privileges on the system, potentially leading to full system compromise. Confidentiality and integrity impacts are high, while availability is not affected. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available in FluxInk Color Management Driver version 1.0.7.6. This fixed version is included in the Windows 11 25H2 Hardware Lab Kit and may be distributed via Windows Update or Lenovo. Users and administrators should update to version 1.0.7.6 as soon as it becomes available through these channels to remediate this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisa-cg
- Date Reserved
- 2026-07-01T15:47:30.055Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4d6893c9d9e3dbe3d5458a
Added to database: 07/07/2026, 20:58:59 UTC
Last enriched: 07/07/2026, 21:13:12 UTC
Last updated: 07/07/2026, 21:32:43 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.