EUVD-2026-44977
GHSA-whrx-5ggp-j935
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and existing low-privileged authenticated user give AV:L/PR:L; passive user interaction maps to UI:R; CWE-250 abuse yields full C/I/A impact with unchanged scope.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
3DescriptionCVE.org
A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.
AnalysisAI
Local privilege escalation to arbitrary code execution affects Lenovo App Store, a software-distribution client shipped exclusively on Lenovo devices in the Chinese market. A local authenticated user who can interact with the application can leverage its excessive privileges (CWE-250) to run arbitrary code at an elevated privilege level, with high confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Technical ContextAI
The affected component is the Lenovo App Store client (cpe:2.3:a:lenovo:app_store), a vendor storefront/updater application bundled on Lenovo consumer systems distributed in China. The root cause is classified as CWE-250 (Execution with Unnecessary Privileges): a process or helper that runs with more privilege than its task requires, allowing a lower-privileged user who can influence that process to have their code executed in the higher-privileged context. Such flaws in software-store/updater agents typically stem from privileged background services or auto-elevating helpers that accept input, actions, or file/binary paths controllable by a standard user without adequately validating the caller or the code being run.
RemediationAI
Consult and follow the Lenovo advisory at https://iknow.lenovo.com.cn/detail/441419 and update the Lenovo App Store to the vendor-fixed build; no vendor-released patch version was identified in the provided data, so the exact fix version must be confirmed directly from that advisory. As a compensating control until patched, restrict which local accounts can log in and run the App Store client on affected Chinese-market Lenovo devices, and consider disabling or removing the Lenovo App Store application/its privileged background service where it is not required (trade-off: users lose vendor app-distribution and update functionality delivered through the store). Because exploitation requires local authenticated access, enforcing least-privilege user accounts and preventing untrusted users from gaining interactive local sessions meaningfully reduces exposure. Do not rely on network controls, as the attack vector is local.
A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with eleva
Local code execution in Lenovo Legion Zone and the Lenovo App Store (China-market Windows builds) allows an authenticate
Local code execution in Lenovo App Store (Chinese-market distribution only) lets an authenticated local user abuse a pat
An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to ex
Same weakness CWE-250 – Execution with Unnecessary Privileges
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today