CVE-2026-77882

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77882", "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "state": "PUBLISHED", "assignerShortName": "lenovo", "dateReserved": "2026-08-21T15:37:14.346Z", "datePublished": "2026-11-11T16:15:43.172Z", "dateUpdated": "2026-11-11T16:15:43.172Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo", "dateUpdated": "2026-11-11T16:15:43.172Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "affected": [{"vendor": "Lenovo", "product": "System Update", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "5.08.03.59", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:lenovo:system_update:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "5.08.03.59"}]}]}], "descriptions": [{"lang": "en", "value": "A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges."}]}], "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-232748", "tags": ["vendor-advisory"]}, {"url": "https://support.lenovo.com/us/en/downloads/ds012808", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "As of October 31, 2026, Lenovo System Update has reached end of support status, and no further updates will be released to address these vulnerabilities. \u00a0Lenovo recommends that users uninstall Lenovo System Update as soon as possible and migrate to Lenovo Commercial Vantage ( Lenovo Commercial Vantage - Lenovo Support US https://support.lenovo.com/us/en/solutions/hf003321 ).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>As of October 31, 2026, Lenovo System Update has reached end of support status, and no further updates will be released to address these vulnerabilities. &nbsp;Lenovo recommends that users uninstall Lenovo System Update as soon as possible and migrate to Lenovo Commercial Vantage (<a href=\"https://support.lenovo.com/us/en/solutions/hf003321\" target=\"_blank\" rel=\"nofollow noopener\" title=\"Follow link\">Lenovo Commercial Vantage - Lenovo Support US</a>).</p>"}]}], "credits": [{"lang": "en", "value": "Lenovo thanks Alexander Wolf for reporting this vulnerability.", "type": "finder"}, {"lang": "en", "value": "Lenovo thanks Nicholas Ineson \u2013 Forefront IT Security Services Ltd for subsequently reporting this vulnerability.", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0-beta"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "System Update", "vendor": "Lenovo", "versions": [{"lessThanOrEqual": "5.08.03.59", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@lenovo.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges."}], "id": "CVE-2026-77882", "lastModified": "2026-11-12T22:09:39.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@lenovo.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@lenovo.com", "type": "Secondary"}]}, "published": "2026-11-11T17:17:20.130", "references": [{"source": "psirt@lenovo.com", "url": "https://support.lenovo.com/us/en/downloads/ds012808"}, {"source": "psirt@lenovo.com", "url": "https://support.lenovo.com/us/en/product_security/LEN-232748"}], "sourceIdentifier": "psirt@lenovo.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "psirt@lenovo.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.08.03.59]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "System Update", "source": "cna", "vendor": "Lenovo"}, "product": "system_update", "vendor": "lenovo"}], "created": "2026-11-12T22:00:09.863130+00:00", "title": "Local Privilege Escalation via Untrusted Deserialization in Lenovo System Update", "updated": "2026-11-13T08:00:07.159422+00:00", "vendors": ["lenovo", "lenovo$PRODUCT$system_update"]}