Lenovo App Store CVE-2026-13104

Exploitation requires the attacker to already be a local authenticated user (PR:L) on a device that has the Lenovo App Store installed - meaning a Lenovo device distributed in the Chinese market - and the flaw is triggered locally (AV:L), not over the network. The CVSS vector further requires passive user interaction (UI:P), so a legitimate user action must occur for the chain to succeed, which is a limiting factor. Exploitation is bounded by the product's region lock (China-only distribution), the need for existing local login credentials, and the presence of the vulnerable App Store client; it does not work against systems without the Lenovo App Store or against remote unauthenticated attackers.

The vendor CVSS 4.0 base score is 7.0 (High) with vector AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H, indicating a local attack vector requiring an already-authenticated low-privileged user plus some passive user interaction, but yielding full high impact to confidentiality, integrity, and availability once triggered. No EPSS score was provided, it is not in CISA KEV, and no POC is referenced, so the practical exploitation signal is low despite the meaningful CVSS - this reads as a real but non-urgent local escalation rather than an internet-facing emergency. The local-only vector and the requirement for existing authenticated access substantially limit blast radius; the primary risk is a standard user or malware already running on the machine escalating to elevated privileges. Because exploitation is local and the product is region-restricted to China, prioritization should be scaled to whether Chinese-market Lenovo devices are in scope. Note the SSVC framework, EPSS, and independent POC data are not supplied, so automatability and exploitation-status are inferred only from the CVSS vector.

A standard authenticated user (or malware running under that user) on a Chinese-market Lenovo PC interacts with the Lenovo App Store client and abuses its unnecessarily elevated privileges to run attacker-supplied code in the higher-privileged context, gaining full control of the system. The CVSS vector's UI:P suggests the chain also depends on some passive user action being present. No public exploit code is identified at time of analysis.