What happens when a reverser gets bored?🤔
Well, obviously they'd reverse their own machine's .sys drivers!
My first ever CVE has finally been credited, along with an advisory mention from Lenovo! Though its not the flashiest finding in the world (local DoS, Medium severity), it's a finding in an area that I'm incredibly passionate about. Plus, there's also that bit of added satisfaction about finding a real bug in the device that you use everyday :D
Turns out the laptop I use every single day was shipping a kernel driver with an out-of-bounds write sitting in one of its IOCTL handlers, where a single malformed request from an unprivileged process was enough to push the driver past its buffer and bugcheck the whole machine.
With the use of everyone's favourite decompiler IDA, I took apart Lenovo's Energy Management driver (AcpiVpc.sys), traced the dispatch routine, and found it was validating the input length but never the output buffer by checking that a request is at least 4 bytes, then happily writes 32. That's 28 bytes straight over the line into non-paged pool.
Reported it to Lenovo PSIRT, who were amazing to work with. Confirmed in days, fixed, and coordinated the disclosure properly. It is now published as CVE-2026-89062!
Have a read👉 https://support.lenovo.com/us/en/product_security/LEN-218444
Also, a little shoutout to the other researcher Artemy Tsetsersky who also reported the same issue as I did, cheers brother! 😆
CVE-2026-89062 | Advisory LEN-218444
