Is there a patch available for CVE-2026-4145?

Yes, a patch is available for CVE-2026-4145. Update the affected software to the latest version immediately.

Lenovo Software Fix CVE-2026-4145

Q: What is the CVSS score of CVE-2026-4145?

CVE-2026-4145 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22928 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-04-15 lenovo

GHSA-p4rv-88gx-v3fc

RCE Lenovo Software Fix

8.5

CVSS 4.0 · Vendor: lenovo

Severity by source

Vendor (lenovo) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local attack, low complexity, low privileges required, no user interaction, full system compromise.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (lenovo).

CVSS VectorVendor: lenovo

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:33 vuln.today

Patch released

Apr 17, 2026 - 15:09 nvd

Patch available

Apr 16, 2026 - 05:29 EUVD

7.5.5.19

CVSS changed

Apr 15, 2026 - 15:22 NVD

7.8 (HIGH) 8.5 (HIGH)

EUVD ID Assigned

Apr 15, 2026 - 12:45 euvd

EUVD-2026-22928

CVE Published

Apr 15, 2026 - 12:28 nvd

HIGH 8.5

DescriptionCVE.org

During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.

AnalysisAI

Local privilege escalation in Lenovo Software Fix versions prior to 7.5.5.19 allows an authenticated local attacker to execute arbitrary code with elevated privileges via argument injection. While the CVSS 4.0 score is 8.5, exploitation requires local authenticated access and no active exploitation or public exploit is known; EPSS probability is extremely low (0.01%).

Technical ContextAI

The vulnerability is rooted in CWE-88 (Improper Neutralization of Argument Delimiters in a Command), suggesting that the application fails to properly sanitize user-supplied arguments before passing them to a system shell. Lenovo Software Fix, identified by CPE cpe:2.3:a:lenovo:software_fix:*:*:*:*:*:*:*:*, likely constructs command strings for system-level operations (e.g., applying fixes or updates) that can be subverted to inject additional commands.

RemediationAI

Upgrade to Lenovo Software Fix version 7.5.5.19 or later, as per the vendor advisory https://support.lenovo.com/us/en/product_security/LEN-213829. If immediate patching is not possible, limit interactive access to trusted users only; fully disabling the software would remove the vector but may prevent the application of critical system fixes.