Lenovo App Store CVE-2025-12046

Requires the target to have Lenovo App Store or Lenovo Browser installed (typically preinstalled Lenovo Windows PCs) and the attacker to already hold local authenticated access (PR:L) to place a malicious DLL where the application resolves it before the legitimate library. Exploitation is limited by the local-only attack vector (no remote path), the need for an existing low-privileged foothold, and the description's 'under certain conditions' qualifier - suggesting a writable/attacker-influenced search directory or a specific execution flow (e.g., an elevated updater or helper process) must be present rather than every default install being vulnerable.

This is a locally-exploitable DLL hijacking (CWE-427) elevation-of-privilege flaw, not the 'Information Disclosure' the tag suggests. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms local attack vector with low pre-existing privileges required and no user interaction, yielding full confidentiality/integrity/availability impact on the vulnerable system - consistent with a low-privileged user gaining SYSTEM/elevated execution. The vendor's 8.5 score is driven by the high impact triple, but the local-only vector and required authenticated foothold sharply limit real-world reach: an attacker must already have code execution on the host. EPSS is very low at 0.14% (2nd percentile), there is no CISA KEV listing, and no public exploit code is referenced, so this reads as a legitimate but non-urgent local privilege-escalation issue rather than a mass-exploitation threat. The description's qualifier 'under certain conditions' implies exploitation is not guaranteed in default states and may depend on the malicious DLL being placed in a writable, prematurely-searched path - this nuance is not reflected in the AC:L rating and should be verified against Lenovo's advisory. No conflicting signals between EPSS and KEV (both indicate low urgency); the main data conflict is the mislabeled 'Information Disclosure' tag versus the CWE-427/EoP reality.

A local authenticated user on a Lenovo PC where Lenovo App Store or Lenovo Browser is installed plants a malicious DLL in a directory the application searches before the legitimate system path. When the application (or its updater/helper running at higher integrity) loads, it resolves the attacker's DLL and executes its code with elevated privileges. No public proof-of-concept is referenced and it is not in CISA KEV.