Lenovo LMSA CVE-2026-63427

The attacker must hold an existing local authenticated user account on the target machine (PR:L per CVSS 4.0) - purely remote unauthenticated exploitation is not possible given AV:L. Lenovo Rescue and Smart Assistant (LMSA) must be installed on the device and its privileged service component must be active. Attack complexity is low (AC:L) with no specific attack prerequisites (AT:N), meaning no race condition, special configuration, or non-default setup is required beyond a standard LMSA installation. No interaction from a privileged user is required (UI:N). Exploitation is bounded to users who can obtain an interactive local session; a remote attacker without a pre-existing foothold on the device cannot directly exploit this vulnerability.

The CVSS 4.0 score of 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) is well-calibrated: low attack complexity with no special prerequisites, full impact on the vulnerable system, and no subsequent system scope change. The local attack vector (AV:L) is the primary risk-limiting factor - a remote unauthenticated attacker cannot exploit this directly and must first obtain local user access via another vector (phishing, physical access, or a separate vulnerability). The low-privilege requirement (PR:L) means any standard interactive account suffices, which is a real threat in enterprise environments with shared Lenovo workstations or where threat actors have already established a foothold. No EPSS score, CISA KEV listing, or POC code is present in the available data, indicating no confirmed active exploitation at time of analysis. Overall, this is a genuine high-severity local privilege escalation rather than a notional or inflated finding, but its practical risk is bounded to scenarios where an attacker already has local authenticated access.

An attacker with a low-privileged local account on an affected Lenovo device running LMSA monitors IPC traffic between the LMSA user-space client and its privileged system service, capturing an authentication token or credential used to authorize elevated operations. The attacker replays the captured token to the privileged LMSA component, which accepts it without adequate freshness or integrity validation, then invokes a privileged LMSA function to execute arbitrary code at elevated (e.g., SYSTEM-level) privileges. No public exploit code has been identified at time of analysis.