{"id":"CVE-2026-77882","kind":"vulnerability","aliases":["CVE-2026-77882"],"related":[],"title":"Lenovo System Update: deserialization flaw lets a local user gain elevated privileges","description":"A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges.","summary":"Lenovo System Update deserializes untrusted data without checking it. A local authenticated user can run code with elevated privileges.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lenovo","lenovo-system-update","vendor","windows"],"not_affected_if":["no-lenovo-system-update-installed"],"how_to_check":"Check the installed Lenovo System Update version (Windows: Programs and Features, or the app's About screen). Lenovo's advisory for this CVE was not yet found, so the affected range is unknown; compare against it once published. Latest known release is 5.08.04.85, but it is not confirmed to contain a fix for this CVE.","fix":null,"status":"open","published_at":"2026-11-11T17:17:20+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","triaged_at":"2026-11-11T17:28:40+00:00","updated_at":"2026-11-11T17:30:00+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-11T17:28:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Lenovo System Update: deserialization flaw lets a local user gain elevated privileges","impact":"high","summary":"Lenovo System Update deserializes untrusted data without checking it. A local authenticated user can run code with elevated privileges.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["lenovo","windows","lenovo-system-update"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user runs code with elevated privileges on the machine","analyst_note":"Find the affected and fixed Lenovo System Update versions in Lenovo's security advisory, linked from https://nvd.nist.gov/vuln/detail/CVE-2026-77882.","how_to_check":"- Check the installed Lenovo System Update version in the application's About or version screen; the sources do not name the affected range.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-lenovo-system-update-installed"],"who_is_affected":"Machines running Lenovo System Update, where a local user with an account can trigger the flaw. The sources do not give the affected version range, so teams should check their Lenovo fleet against Lenovo's advisory.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":4503,"output_tokens":475,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Lenovo System Update versions in Lenovo's security advisory, linked from https://nvd.nist.gov/vuln/detail/CVE-2026-77882.","search":"'-2026':14A,17A '-77882':15A,18A 'allow':59C 'authent':37B,62C 'check':33B 'code':41B,66C 'could':58C 'cve':13A,16A 'data':31B,49C 'deseri':4A,29B,46C 'discov':52C 'elev':11A,43B,68C 'execut':65C 'flaw':5A 'gain':10A 'lenovo':1A,19B,21B,26B,54C 'lenovo-system-upd':20B 'let':6A 'local':8A,36B,61C 'privileg':12A,44B,69C 'run':40B 'system':2A,22B,27B,55C 'untrust':30B,48C 'updat':3A,23B,28B,56C 'user':9A,38B,63C 'vendor':24B 'vulner':50C 'window':25B 'without':32B","nicknames":[],"mitigations":[],"who_affected":"Machines running Lenovo System Update, where a local user with an account can trigger the flaw. The sources do not give the affected version range, so teams should check their Lenovo fleet against Lenovo's advisory.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","lenovo","lenovosystemupdate","vendor","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-77882':15A,18A 'cve':13A,16A 'deseri':4A 'elev':11A 'flaw':5A 'gain':10A 'lenovo':1A 'let':6A 'local':8A 'privileg':12A 'system':2A 'updat':3A 'user':9A","search_b":"'authent':37B 'check':33B 'code':41B 'data':31B 'deseri':29B 'elev':43B 'lenovo':19B,21B,26B 'lenovo-system-upd':20B 'local':36B 'privileg':44B 'run':40B 'system':22B,27B 'untrust':30B 'updat':23B,28B 'user':38B 'vendor':24B 'window':25B 'without':32B","search_c":"'allow':59C 'authent':62C 'code':66C 'could':58C 'data':49C 'deseri':46C 'discov':52C 'elev':68C 'execut':65C 'lenovo':54C 'local':61C 'privileg':69C 'system':55C 'untrust':48C 'updat':56C 'user':63C 'vulner':50C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@lenovo.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77882","severity":null,"published_at":"2026-11-11T17:17:20+00:00","modified_at":"2026-11-11T17:17:20+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","fetched_at":"2026-11-11T17:28:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-77882:3571","url":null,"severity":null,"published_at":"2026-11-11T17:30:00+00:00","modified_at":"2026-11-11T17:30:00+00:00","first_seen_at":"2026-11-11T17:30:00+00:00","fetched_at":"2026-11-11T17:30:00+00:00","note":"Brand new CVE (published today). Lenovo's own advisory for it not found; NVD page returned nothing, searches only surface sibling CVE-2026-6387 (fixed 5.08.04.85, a different bug). Affected/fixed versions unknown; not inferred from sibling. Recheck for a LEN- advisory on support.lenovo.com/product_security."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}