What’s Vulnerable › Vulnerabilities

CVE-2026-58583: FluxInk Color Management Driver local privilege escalation

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-07 · updated 2026-10-25
• Weakness: CWE-269

Description

FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privilege escalation for a standard user account via arbitrary physical memory mapping at \Device\PhysicalMemory. Fixed in version 1.0.7.6. The fixed driver is currently available in the Windows 11 25H2 HLK (Hardware Lab Kit). The fixed driver may be available through Windows Update or from Lenovo directly.

Affected products

• FluxInk Color Management Driver: before 1.0.7.6 — fixed in 1.0.7.6

How to fix

Upgrade to a fixed version: FluxInk Color Management Driver 1.0.7.6. Check the vendor advisory for mitigations.

References

• https://github.com/b3s3da/TcnPeripheral64_PoC
• https://github.com/b3s3da/TcnPeripheral64_PoC/security/advisories/GHSA-x4rw-h4v2-v83h
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-188-01.json
• https://www.cve.org/CVERecord?id=CVE-2026-58583

Get alerted when CVE-2026-58583 or the next vulnerability affects your stack