Deserialization of Untrusted Data Vulnerability in Lenovo System Update
CVE-2026-77882

8.5HIGH

Key Information:

Vendor

Lenovo
Status
System Update
Vendor
CVE Published:
11 November 2026

What is CVE-2026-77882?

A vulnerability has been identified in Lenovo System Update that involves the deserialization of untrusted data. This issue could enable local authenticated users to execute code with elevated privileges. By exploiting this vulnerability, attackers could potentially gain access to sensitive areas of the system, risking the integrity of the software and the security of user data. It is crucial for users of the affected product to remain vigilant and apply any available security updates promptly to mitigate potential threats.

Affected Version(s)

System Update 0 <= 5.08.03.59

References

https://support.lenovo.com/us/en/product_security/LEN-232748
vendor-advisory
https://support.lenovo.com/us/en/downloads/ds012808
product

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lenovo thanks Alexander Wolf for reporting this vulnerability.
Lenovo thanks Nicholas Ineson – Forefront IT Security Services Ltd for subsequently reporting this vulnerability.
.