Lenovo Legion Zone CVE-2026-75941

Exploitation requires the attacker to be positioned on the same logical network as the target (CVSS AV:A - adjacent, e.g., shared LAN or Wi-Fi segment) and to hold low-level privileges (PR:L), with no user interaction needed (UI:N). The affected software is the Lenovo Legion Zone application, which is distributed exclusively in the Chinese market, so only devices running that China-specific build are in scope - this market restriction and the adjacency requirement are the principal factors limiting real-world exploitation. The vulnerability class is unsafe deserialization of untrusted data (CWE-502), implying the attacker must be able to reach the application's data-processing interface over the local network and supply a malicious serialized object.

This is a moderate-to-high severity but realistically constrained issue. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.6 and indicates adjacent-network access with low attack complexity, low privileges required, and no user interaction, yielding full high impact to confidentiality, integrity, and availability on the vulnerable system (no subsequent-system scope change). The core limiting signal is AV:A - the attacker must already be on the same logical network (e.g., the same LAN/Wi-Fi segment), which excludes pure internet-based mass exploitation and is corroborated by the description ('an attacker on the same logical network'). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is driven by severity potential rather than observed in-the-wild activity. Tempering factors: the product is distributed exclusively in the Chinese market and is a consumer gaming utility, sharply narrowing the realistic target population. CWE-502 (deserialization) combined with the RCE tag makes the arbitrary-code-execution claim technically plausible. Net: a legitimate patch-worthy flaw for affected Chinese-market Legion devices, but not a broad emergency given adjacency requirement, required privileges, and absence of exploitation signals.

An attacker already present on the same local network segment as a victim's Lenovo Legion device (for example, a shared office or public Wi-Fi network) sends crafted serialized data to the Legion Zone application's exposed interface, triggering unsafe deserialization (CWE-502) and achieving arbitrary code execution on the host. Exploitation requires low-level privileges and no user interaction (PR:L/UI:N), but is bounded to adjacent-network reach (AV:A). No public exploit code has been identified at time of analysis.