Read the docs
TI-2018-06579 Aliases CVE-2018-9063GHSA-wp87-97vq-c79x

Memory corruption in Lenovo System Update

Priority LOW 34CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very large user ID or password can overrun the program's buffer, causing undefined behaviors, such as execution of arbitrary code. No additional privilege is granted to the attacker beyond what is already possessed to run MapDrv.

Why it matters now

EPSS 0.00378 32nd percentileScored 2026-11-07
Fix Fixed Lenovo System Update (Lenovo Group Ltd.): 5.07.0072

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoLenovo System Updatebefore 5.07.00725.07.0072Patch availableCNA
  • Lenovo System Update VendorLenovo Affected before 5.07.0072 Fixed in 5.07.0072 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lenovo:system_update:*:*:*:*:*:*:*:*before 5.07.0072VulnerableLenovo
  • cpe:2.3:a:lenovo:system_update:*:*:*:*:*:*:*:* Versions before 5.07.0072 Vulnerable ·Lenovo

Remediation

  • Fix · CNA Lenovo System Update (Lenovo Group Ltd.) Fixed in 5.07.0072

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-9063
  2. 2026-10-03 Alias added: GHSA-wp87-97vq-c79x

References

Advisory 1

  • TI-2015-01977 Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses… CVSS 2.0HIGH 7.2
  • TI-2023-04271 Uncontrolled search path in Lenovo System Update CVSS 3.1HIGH 7.8
  • TI-2022-00280 A vulnerability was reported in Lenovo System Update that could allow a local user with… CVSS 3.1HIGH 7.8
  • TI-2019-04375 System Update Vulnerability CVSS 3.1HIGH 7.5
  • TI-2015-01983 Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not… CVSS 2.0HIGH 8.3
  • TI-2022-04172 A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges. CVSS 3.1HIGH 7.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences