Lenovo Accessories and Display Manager CVE-2026-9045

Attacker must already have a valid low-privileged authenticated session (PR:L) on a Windows endpoint where Lenovo Accessories and Display Manager for Enterprise is installed and the vulnerable privileged component (service/IPC endpoint) is running; exploitation is local only (AV:L), so remote network exploitation is not possible without a prior foothold. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race window, environmental tuning, or victim action is needed once the attacker can execute code on the host. The vulnerability is limited to environments running the Enterprise edition of Accessories and Display Manager on Windows - consumer-grade Lenovo accessory software, non-Lenovo hardware, and endpoints without this specific package installed are not exposed.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H confirms a local, low-complexity, no-user-interaction privilege escalation requiring only low-privilege authentication, yielding a base score of 8.5 - appropriate for a reliable Windows LPE. No EPSS score, KEV listing, or public POC has been published, and exploitation status is no public exploit identified at time of analysis, so this is not a fire-drill internet-facing emergency. However, the risk is meaningful in enterprise fleets that deploy this Lenovo software at scale: LPE bugs in vendor-shipped management utilities are routinely chained by malware and red teams for post-foothold elevation, and the vulnerability was found by Lenovo's own internal assessment (reducing the chance of an in-the-wild surprise but raising the chance of researcher follow-up POCs once the patch is reversed). Prioritize patching on managed Lenovo Windows endpoints, especially shared/multi-user systems and any host accessible to lower-trust users.

A standard domain user who has already obtained interactive or RDP access to a Lenovo workstation - through phishing, stolen credentials, or insider access - runs a small utility that opens the unauthenticated IPC/service interface exposed by Accessories and Display Manager for Enterprise and invokes the privileged function to execute attacker-supplied code in the SYSTEM context. With SYSTEM, the attacker dumps LSASS, harvests credentials, and pivots laterally. No public POC has been released, but CWE-306 LPE bugs in Windows OEM management agents are historically straightforward to reproduce once the IPC surface is reverse-engineered from the patched binary.