CVE-2025-8061: Lenovo Dispatcher Privilege Escalation

CVE-2025-8061 Overview

CVE-2025-8061 is an insufficient access control vulnerability in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers shipped with some Lenovo consumer notebooks. An authenticated local user can leverage the flaw to execute code with elevated privileges. The Lenovo Dispatcher 3.2 driver is not affected. Systems with the Windows feature Core Isolation Memory Integrity enabled are not exposed, and Lenovo systems preloaded with Windows 11 have this feature on by default. The weakness is classified under [CWE-782: Exposed IOCTL with Insufficient Access Control].

Critical Impact
An authenticated local attacker can escalate privileges through the vulnerable Dispatcher driver, gaining code execution at kernel or SYSTEM level on affected Lenovo consumer notebooks.

Affected Products

Lenovo Dispatcher 3.0 driver on select Lenovo consumer notebooks
Lenovo Dispatcher 3.1 driver on select Lenovo consumer notebooks
Windows systems without Core Isolation Memory Integrity enabled

Discovery Timeline

2025-09-11 - CVE-2025-8061 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8061

Vulnerability Analysis

The Lenovo Dispatcher driver exposes device control interfaces that do not enforce sufficient access restrictions on calling processes. An authenticated local user can open a handle to the driver and issue crafted I/O control (IOCTL) requests that the driver processes with kernel privileges. Because the driver runs in ring 0, successful abuse permits arbitrary code execution or manipulation of privileged operations from a low-integrity context.

The issue is characteristic of the [CWE-782] pattern, where a Windows driver exposes IOCTLs to unprivileged callers without validating the caller's security context. Attackers commonly abuse such interfaces to read or write kernel memory, map physical memory, or execute privileged instructions.

Root Cause

The root cause is missing or insufficient access control on the driver's device object and IOCTL handlers in Dispatcher 3.0 and 3.1. Lenovo addressed the flaw in the Dispatcher 3.2 driver, which introduces the required restrictions. Enabling Windows Hypervisor-protected Code Integrity (HVCI), exposed as Core Isolation Memory Integrity, neutralizes the exploitation path by preventing unsigned or unauthorized code from executing in kernel mode.

Attack Vector

Exploitation requires local access and valid credentials on the target notebook. An attacker with a standard user session opens the Dispatcher driver's device interface, submits crafted IOCTL requests, and abuses the resulting privileged primitive to elevate to SYSTEM or execute code in kernel context. Remote exploitation is not possible. See the Lenovo Security Advisory LEN-200860 for vendor technical details.

Detection Methods for CVE-2025-8061

Indicators of Compromise

Presence of Dispatcher 3.0 or 3.1 driver files on Lenovo consumer notebooks where the vendor patch has not been applied
Unexpected process creation of high-privilege processes spawned from standard-user sessions shortly after handles are opened to the Dispatcher device object
Loading of the vulnerable Dispatcher driver on systems where Core Isolation Memory Integrity is disabled

Detection Strategies

Inventory endpoints for the Dispatcher driver version and flag hosts running 3.0 or 3.1
Monitor for user-mode processes opening handles to the Dispatcher device and issuing IOCTLs, correlated with subsequent privilege changes
Alert on driver load events matching the vulnerable Dispatcher versions on managed Lenovo hardware

Monitoring Recommendations

Enable Windows Defender Application Control or WDAC-equivalent driver blocklists to log or block the vulnerable driver
Collect Sysmon Event ID 6 (driver load) and Event ID 1 (process create) to correlate driver activity with privilege escalation attempts
Track the state of Core Isolation Memory Integrity across the fleet and alert when it is disabled on Lenovo hardware

How to Mitigate CVE-2025-8061

Immediate Actions Required

Update the Lenovo Dispatcher driver to version 3.2 or later on all affected consumer notebooks
Enable Windows Core Isolation Memory Integrity on any Lenovo system where it is currently disabled
Restrict local logon rights and enforce least privilege to limit which users can invoke the driver

Patch Information

Lenovo has released Dispatcher 3.2, which is not affected by this vulnerability. Refer to the Lenovo Security Advisory LEN-200860 for driver download links, affected model lists, and installation guidance.

Workarounds

Enable Windows Core Isolation Memory Integrity (HVCI) to block exploitation on unpatched systems
Remove or disable the Dispatcher 3.0 and 3.1 drivers where the software is not required
Apply Microsoft's vulnerable driver blocklist to prevent the affected driver from loading

bash

# Verify Core Isolation Memory Integrity (HVCI) status on Windows
reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled

# Enable HVCI (requires reboot)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 1 /f