Lenovo PC Manager CVE-2025-8486

Exploitation requires that Lenovo PC Manager be installed on the target Windows host and that the attacker already hold local, low-privilege authenticated access (PR:L, AV:L) - e.g. a standard user account or code running in that context. No user interaction is required (UI:N) and attack complexity is low (AC:L). The key limiting factors are the need for a pre-existing local foothold (this is not remotely exploitable) and the presence of the Lenovo PC Manager software, which is typically found only on Lenovo-branded systems rather than general enterprise fleets. The description does not identify a specific non-default feature or configuration toggle as a precondition, implying default installations are affected.

Signals point to a genuine but non-urgent local privilege-escalation issue rather than a mass-exploitation priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms local access with low existing privileges and no user interaction, yielding high confidentiality, integrity and availability impact on the vulnerable system - consistent with CWE-250 (execution with unnecessary privileges). The EPSS score is very low (0.15%, 4th percentile), the CVE is NOT in CISA KEV, and no public exploit was identified, so the aggregate picture is a high-severity-but-low-real-world-exploitation flaw. There is no SSVC decision data provided. Note a mild tension worth flagging: the description hedges with 'potential vulnerability that could allow,' which is weaker than the confident HIGH CVSS the vendor assigned - the local-only vector (AV:L) and required pre-existing authenticated access (PR:L) substantially limit real-world risk despite the 8.5 score, since an attacker must already have a foothold on the host.

A local authenticated user (or malware running in that user's context) on a Windows machine with Lenovo PC Manager installed abuses the application's over-privileged execution (CWE-250) to run attacker-controlled code at elevated/SYSTEM privileges. No public exploit code was identified at time of analysis, and because the attack vector is local (AV:L) the attacker must already have an interactive or code-execution foothold on the host before escalating.