CVE-2025-8061

State: Published
Severity: 7.3 High
Published: Sep 11, 2025
Updated: Sep 22, 2025
Reserved: Jul 22, 2025

Description

A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Lenovo consumer notebooks that could allow an authenticated local user to execute code with elevated privileges. The Lenovo Dispatcher 3.2 driver is not affected. This vulnerability does not affect systems when the Windows feature Core Isolation Memory Integrity is enabled. Lenovo systems preloaded with Windows 11 have this feature enabled by default.

Scores

CVSS	Score	Vector	Source
4.0	7.3 High	CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	lenovo
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	lenovo

Weaknesses

CWE-782 Exposed IOCTL with Insufficient Access Control

Affected Products

Product	Versions
Dispatcher 3.0 DriverLenovo	before 3.1.0.41Affected
Dispatcher 3.1 DriverLenovo	before 3.1.0.41Affected

References

https://support.lenovo.com/us/en/product_security/LEN-200860

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.