Lenovo One Client CVE-2025-13152

Requires the attacker to already be a local, authenticated user on a Windows host with Lenovo One Client installed (PR:L, AV:L). Exploitation depends on placing a malicious DLL in a filesystem location that a Lenovo One Client process searches ahead of the legitimate library and then getting that process to load it. Limiting factors: no remote/network access is possible, the product must be installed (not universal even on Lenovo hardware), and the attacker needs write access to a directory in the DLL search path. No user interaction by a second party is required (UI:N).

This is a local privilege-escalation issue via DLL hijacking (CWE-427), and the signals converge on genuine-but-not-urgent priority. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms the attacker must already have local, authenticated access - this is not a remote or network-reachable flaw despite the 8.5 headline score, which is inflated by the CVSS 4.0 scoring of full high C/I/A impact. EPSS is very low at 0.14% (2nd percentile), consistent with a local-only, non-wormable EoP that requires an existing foothold. There is no CISA KEV listing, no public POC, and the report originates from Lenovo's own internal security assessment (psirt@lenovo.com) rather than field observation of exploitation. The practical read: a real defense-in-depth issue for machines running Lenovo One Client, useful to a local attacker chaining to SYSTEM/elevated privileges, but not a mass-exploitation or emergency-patch scenario. Note the input Tag 'Information Disclosure' conflicts with the actual impact - this is code execution / privilege escalation, not disclosure.

A local authenticated user (or malware running in that user's context) plants a malicious DLL in a directory searched before the legitimate one by a Lenovo One Client process, then triggers the vulnerable component to load it, executing attacker code at the elevated privilege level of that process. No public exploit code is identified at time of analysis; the flaw was found during Lenovo's internal assessment. Low attack complexity means a working DLL-plant is straightforward once the search-order gap is known.