A buffer overflow flaw exists in the Lenovo Virtual Bus driver component of Smart Connect. When exploited by a local authenticated user, the overflow can corrupt memory and trigger a Windows blue screen of death. This vulnerability is classified as CWE-122 (Buffer Copy without Checking Size or Boundary). The primary consequence is a denial of service through forced system crash, without known direct data compromise.

The issue affects Lenovo Smart Connect installations on Windows using the Virtual Bus driver. All versions prior to the patched release 09.0.1.002.000 are considered vulnerable. The affected platform can be identified via the CPE string cpe:2.3:a:lenovo:smart_connect:*:*:windows:*:*:*:*:*.

With a CVSS score of 6.9 and an EPSS of less than 1%, the technical severity is moderate while the likelihood of exploitation is low. The vulnerability requires local, authenticated access and cannot be triggered remotely, thus limiting exposure. The issue is not present in the CISA Known Exploited Vulnerabilities catalog.