CVE-2026-77882

HighCVSS 7.8/10Last modified Nov 12, 2026

Description

A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 11, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-778834.9Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for DerCVE-2026-778847.1Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCVE-2026-778867.5Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.CVE-2026-778876.4Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execute code locally.CVE-2026-778887.5Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a CVE-2026-778897.5Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a CVE-2026-778907.5Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a CVE-2026-778916.4Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execute code locally.CVE-2026-778926.8No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-778937.5Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.CVE-2026-778947.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attackCVE-2026-778957.5Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
CVE-2026-77882: High severity, CVSS 7.8 | Vulnix