Lenovo PC Manager CVE-2025-10581

Requires a local, authenticated low-privileged user able to write a malicious DLL into a directory within Lenovo PC Manager's DLL search order (CWE-427 uncontrolled search path). Exploitation is gated by needing prior local code execution or interactive logon on a machine with Lenovo PC Manager installed, and by the ability to write to a location the elevated PC Manager process loads before the legitimate DLL. No network reach, no victim user interaction, and no administrative privileges are needed, but remote and unauthenticated exploitation is NOT possible given AV:L/PR:L.

Signals point to a moderate, locally-scoped privilege-escalation risk rather than an urgent remote threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms exploitation requires local access by an already-authenticated low-privileged user - not a remote, unauthenticated vector - while VC:H/VI:H/VA:H reflect full compromise of the local host once the DLL hijack succeeds. EPSS is very low (0.15%, 4th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation; these low-exploitation signals are consistent with each other and with a local-only CWE-427 DLL search-path flaw. The vendor-assigned 8.5 score is driven by the HIGH triple impact, not by ease of reach, so this is best treated as a local EoP to prioritize on Lenovo endpoints during routine patching rather than an emergency. One data note: the input Tags label this 'Information Disclosure,' which conflicts with the description (code execution with elevated privileges) and the VI:H/VA:H integrity/availability impacts - the flaw is privilege escalation / code execution, so the tag appears mislabeled.

A low-privileged but authenticated user (or malware already running in that user's context) on a Lenovo PC places a malicious DLL in a directory that Lenovo PC Manager searches ahead of the legitimate library. When the elevated PC Manager process loads the planted DLL, the attacker's code executes with the higher privileges of that process, achieving local privilege escalation. No public exploit is identified at time of analysis; the low complexity (AC:L) makes it straightforward once local access is obtained.