Lenovo Dock Manager CVE-2026-63425

Exploitation requires an existing local authenticated session on the target Windows machine with at least standard (low-privilege) user rights, as confirmed by the CVSS 4.0 metrics AV:L and PR:L. Lenovo Dock Manager must be installed and active on the system. No network access is required or applicable - this is a purely local attack path. Exploitation is limited by the need for physical or remote (e.g., RDP) local login access; environments that enforce strict user access controls, single-user workstations, or privileged access workstations (PAWs) significantly reduce realistic exposure. No special application feature needs to be enabled beyond the baseline Dock Manager installation.

The CVSS 4.0 score of 8.5 (High) reflects high confidentiality, integrity, and availability impact within the vulnerable system, constrained by the local attack vector. The metrics AV:L and PR:L confirm this is not remotely exploitable and requires an existing authenticated foothold on the target machine - a meaningful barrier in most enterprise configurations with strict access controls. No EPSS data was provided, so exploitation probability cannot be quantified from that source. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept has been identified at time of analysis. Taken together, this presents as a real and well-evidenced local privilege escalation with moderate real-world priority: high relevance for environments where multiple users share Lenovo workstations or where insider threat and post-compromise lateral movement are threat model concerns, but lower urgency for environments with strict single-user physical access policies. The absence of EPSS data and KEV listing is consistent with the vendor-internal discovery path.

An attacker with a low-privileged local account on a Windows system running Lenovo Dock Manager identifies a world-writable directory or executable path used by the Dock Manager service. The attacker replaces or plants a malicious binary or DLL in that location, then waits for or triggers the Dock Manager service to load or execute the payload, resulting in code execution at an elevated privilege level such as SYSTEM or local Administrator. No public exploit code exists at time of analysis, but the low attack complexity (AC:L) suggests the technique is straightforward once the misconfigured resource is identified.