Description
A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.
Published: 2026-10-15
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Denial of Service via out‑of‑bounds write in Lenovo Energy Management Driver
Action: Patch
AI Analysis

Impact

A local authenticated user can trigger an out‑of‑bounds write in the Lenovo Energy Management Driver, causing a blue‑screen error. This flaw leads to system crash and denial of service but does not provide direct data disclosure or privilege escalation.

Affected Systems

Lenovo Energy Management Driver on Lenovo hardware. No specific product version is listed, but any installation of this driver is potentially vulnerable and should be updated.

Risk and Exploitability

The CVSS score is 6.8, indicating moderate severity. The EPSS score of 0.00093 indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local authenticated access, making it a local attack vector. As such, the risk is moderate but confined to environments where a user can run the driver.

Generated by OpenCVE AI on October 16, 2026 at 16:20 UTC.

Remediation

Vendor Solution

Update to the version (or newer) indicated for your model in the advisory - https://support.lenovo.com/us/en/product_security/LEN-218444

OpenCVE Recommended Actions

  • Apply the Lenovo driver update described in the advisory: upgrade the Energy Management Driver to the version indicated for your model or newer, which addresses the out‑of‑bounds write flaw (CWE‑787).
  • Disable or remove the affected Energy Management Driver if no update is available, thereby eliminating the risk of an out‑of‑bounds write (CWE‑787).
  • Keep system firmware and BIOS updated to mitigate potential related issues.
  • Monitor for unplanned reboots or blue‑screen events as an indicator of exploitation attempts.
  • Configure the driver to run with minimal privileges to limit the impact of bounds violations.

Generated by OpenCVE AI on October 16, 2026 at 16:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Title Local Out‑of‑Bounds Write in Lenovo Energy Management Driver Causing Blue Screen

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Title Local Out‑of‑Bounds Write in Lenovo Energy Management Driver Causing Blue Screen

Thu, 15 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Description A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.
First Time appeared Lenovo
Lenovo energy Management Driver
Weaknesses CWE-787
CPEs cpe:2.3:a:lenovo:energy_management_driver:*:*:*:*:*:*:*:*
Vendors & Products Lenovo
Lenovo energy Management Driver
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Lenovo Energy Management Driver
cve-icon MITRE

Status: PUBLISHED

Assigner: lenovo

Published:

Updated: 2026-10-16T14:05:04.916Z

Reserved: 2026-09-10T18:31:23.916Z

Link: CVE-2026-89062

cve-icon Vulnrichment

Updated: 2026-10-16T14:04:49.588Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-16T00:17:07.037

Modified: 2026-10-16T19:55:59.740

Link: CVE-2026-89062

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T15:30:17Z

Weaknesses