CVE-2026-58583: FluxInk Driver Privilege Escalation Flaw

CVE-2026-58583 Overview

CVE-2026-58583 is a local privilege escalation vulnerability in the FluxInk (formerly Sunia SPB Peripheral) Color Management Driver TcnPeripheral64.sys version 1.0.7.2. The driver exposes arbitrary physical memory mapping through \Device\PhysicalMemory, allowing a standard user account to read and write kernel memory. Successful exploitation grants attackers SYSTEM-level code execution on affected Windows hosts. The issue is classified under [CWE-269] Improper Privilege Management. Lenovo fixed the flaw in driver version 1.0.7.6, which is currently distributed through the Windows 11 25H2 Hardware Lab Kit (HLK).

Critical Impact
A standard user can escalate to SYSTEM by abusing the vulnerable driver to map arbitrary physical memory pages into user space.

Affected Products

FluxInk (formerly Sunia SPB Peripheral) Color Management Driver TcnPeripheral64.sys version 1.0.7.2
Windows systems shipping the vulnerable Lenovo peripheral driver
Endpoints where the signed vulnerable driver can be loaded (BYOVD scenarios)

Discovery Timeline

2026-07-07 - CVE-2026-58583 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58583

Vulnerability Analysis

The TcnPeripheral64.sys driver ships with an IOCTL handler that grants unrestricted access to the \Device\PhysicalMemory section object. This kernel section maps the machine's physical RAM directly. When a local user opens a handle to the driver, the driver returns a mapped view into caller-controlled physical addresses without validating the caller's privilege level or restricting the address range.

An attacker running as a standard user can read and modify kernel structures, including the EPROCESS token pointer. Overwriting the current process token with the SYSTEM token yields immediate privilege escalation. The vulnerability requires local access but no administrative rights, which makes it attractive for post-compromise operators and for Bring Your Own Vulnerable Driver (BYOVD) attacks against hosts that never installed the Lenovo peripheral.

Root Cause

The driver fails to enforce access controls on physical memory mapping operations. Section objects backing physical memory should be restricted to kernel components or administrators. TcnPeripheral64.sys 1.0.7.2 exposes this primitive to any authenticated caller, satisfying [CWE-269] Improper Privilege Management.

Attack Vector

Exploitation is strictly local. An attacker with a standard user account opens a handle to the driver device, issues the vulnerable IOCTL to map physical memory containing kernel objects, locates the target process EPROCESS structure, and swaps the security token. A public proof of concept is published in the TcnPeripheral64 PoC repository and detailed in the GitHub Security Advisory GHSA-x4rw-h4v2-v83h.

Refer to the linked advisory for technical details on the IOCTL codes and memory mapping mechanics. No verified sanitized exploit code is reproduced here.

Detection Methods for CVE-2026-58583

Indicators of Compromise

Presence of TcnPeripheral64.sys version 1.0.7.2 on disk, particularly on systems without Lenovo peripheral hardware installed
Non-administrative processes opening handles to the TcnPeripheral64 device object
Section mappings referencing \Device\PhysicalMemory originating from user-mode processes

Detection Strategies

Hunt for driver load events (Windows event ID 6 in Sysmon) that reference TcnPeripheral64.sys with hash matching the vulnerable 1.0.7.2 build
Correlate standard-user process creation with subsequent SYSTEM-integrity child processes on the same host to identify token-swap privilege escalation
Alert on any user-mode process issuing DeviceIoControl calls to the FluxInk peripheral device while lacking corresponding Lenovo peripheral hardware telemetry

Monitoring Recommendations

Enable Microsoft's vulnerable driver blocklist and monitor blocklist policy violations
Log CreateFile operations against \\.\TcnPeripheral64 and similar device paths using EDR file and device telemetry
Track kernel driver inventory across the fleet and flag TcnPeripheral64.sys builds prior to 1.0.7.6

How to Mitigate CVE-2026-58583

Immediate Actions Required

Inventory endpoints for TcnPeripheral64.sys and identify systems running version 1.0.7.2
Update the driver to version 1.0.7.6 via Windows Update or directly from Lenovo where available
Uninstall the FluxInk / Sunia SPB Peripheral Color Management software on hosts that do not require it
Add the vulnerable driver hash to the Microsoft Vulnerable Driver Blocklist and to application control policies (WDAC)

Patch Information

Lenovo released the fixed driver in version 1.0.7.6. The patched driver is currently available in the Windows 11 25H2 Hardware Lab Kit (HLK) and may be distributed through Windows Update or directly by Lenovo. See the CISA CSAF advisory and the CVE-2026-58583 record for authoritative references.

Workarounds

Remove or disable the vulnerable driver where the peripheral is not in use, preventing the kernel from loading TcnPeripheral64.sys
Enforce Windows Defender Application Control (WDAC) policies that deny loading of the pre-1.0.7.6 driver by file hash
Restrict local logon rights on shared and kiosk systems to reduce exposure to local privilege escalation

bash

# Example: block the vulnerable driver via WDAC policy generation
# Generate a deny rule based on the file hash of TcnPeripheral64.sys 1.0.7.2
New-CIPolicyRule -DriverFilePath 'C:\Windows\System32\drivers\TcnPeripheral64.sys' -Level Hash -Deny