Lenovo File Manager CVE-2026-18994

Exploitation requires local access to an Android device running the Lenovo File Manager application as distributed in the Chinese market. The attacker must have the ability to install a co-installed application (PR:L) or operate as a low-privileged local user on the device - remote unauthenticated exploitation is not possible given AV:L. The flaw is limited to devices running the Chinese-market distribution of Lenovo File Manager; devices receiving the international build are outside scope. No specific feature toggle or non-default configuration is described as a prerequisite, but the improperly exported component must be reachable by the calling application, which requires the target app to be installed and the Android package manager to resolve the exported component.

Real-world risk is materially lower than the CVSS 4.0 score of 8.4 suggests because exploitation is strictly local: the attacker must have a low-privileged account or a co-installed application on the same Android device, and the product is distributed exclusively in the Chinese market, dramatically reducing the global attack surface. No public exploit code has been identified and the vulnerability is absent from CISA KEV, meaning active exploitation is unconfirmed. The combination of AV:L and Chinese-market-only distribution means that even a mid-sized municipal IT team in swidnica would be extremely unlikely to encounter this vulnerability in their device fleet unless they specifically procure Lenovo devices through Chinese retail channels. The primary realistic threat is a malicious co-installed app silently abusing the exported component - a scenario more relevant to enterprise MDM environments managing employee devices sourced from the Chinese market than to opportunistic remote attacks. Availability is unaffected (VA:N/SA:N), focusing risk entirely on data confidentiality and integrity.

An attacker installs a malicious companion application on an Android device running the vulnerable version of Lenovo File Manager. The malicious app calls the improperly exported component - likely a content provider URI - without presenting any credentials, and directly reads or overwrites files that Lenovo File Manager is supposed to protect, such as managed documents or credential stores within the app's data directory. No public proof-of-concept has been identified, but the attack is straightforward for any developer familiar with Android inter-process communication patterns.