Which versions of Legion Zone are affected by CVE-2026-9046?

Lenovo Legion Zone and App Store in China-market Windows builds contain a local privilege escalation vulnerability (CVE-2026-9046) allowing local users to execute arbitrary code when installed on…. A patch is available.

How to fix or mitigate CVE-2026-9046?

Within 24 hours, conduct a complete inventory of all systems running Lenovo Legion Zone or Lenovo App Store (specifically China-market builds) and identify which installations exist on non-system partitions; flag these as high-priority assets. Within 7 days, implement immediate compensating controls by restricting write permissions on the partition where these applications are installed, disabling unnecessary local administrative accounts on affected systems, and deploying file integrity monitoring for application directories. Within 30 days, monitor Lenovo's advisory for patch availability and establish a removal or upgrade timeline if no patch is released; in the interim, consider migrating to system partition installations where feasible and restrict future deployments of these utilities to system-drive-only locations.

Legion Zone CVE-2026-9046

Q: What is the CVSS score of CVE-2026-9046?

CVE-2026-9046 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-44975 HIGH

Insecure Inherited Permissions (CWE-277)

2026-07-16 lenovo

GHSA-6j6v-724c-h5fm

RCE Microsoft Lenovo App Store Legion Zone

7.3

CVSS 4.0 · Vendor: lenovo

Severity by source

Vendor (lenovo) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Local vector with an existing low-priv account (AV:L/PR:L); the required non-system-partition install maps AT:P to AC:H; planted code runs with full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (lenovo).

CVSS VectorVendor: lenovo

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 16, 2026 - 18:18 EUVD

Analysis Generated

Jul 16, 2026 - 17:16 vuln.today

CVE Published

Jul 16, 2026 - 16:48 cve.org

HIGH 7.3

DescriptionCVE.org

A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrary code.

AnalysisAI

Local code execution in Lenovo Legion Zone and the Lenovo App Store (China-market Windows builds) allows an authenticated local user to run arbitrary code when either application is installed on a non-system partition. The flaw stems from insecure directory/file permissions (CWE-277) that a low-privileged user can abuse to plant or modify executable content later run with higher privilege. No public exploit is identified at time of analysis and it is not listed in CISA KEV; impact is confined to systems where these Chinese-market Lenovo utilities are deployed to a non-default drive.

Technical ContextAI

The affected software comprises two Lenovo Windows client applications distributed exclusively in China: Legion Zone (a gaming companion/optimization utility for Lenovo Legion hardware) and the Lenovo App Store (a software-distribution client). CPE data confirms the products cpe:2.3:a:lenovo:legion_zone and cpe:2.3:a:lenovo:app_store. The root cause is CWE-277 (Insecure Inherited Permissions): when an installer places application directories on a non-system partition, those partitions do not inherit the restrictive ACLs that Windows applies by default to %ProgramFiles% on the system volume. A newly created folder on a secondary drive typically grants write access to standard/Authenticated Users, so any local user can overwrite or add binaries, DLLs, or scripts in the application's path that are subsequently executed by the application or its services/updaters, yielding arbitrary code execution.

RemediationAI

Follow the Lenovo advisory at https://iknow.lenovo.com.cn/detail/441420 and update Legion Zone and the Lenovo App Store to the vendor-corrected version; the supplied data does not include an exact fix version, so treat patch status as 'Patch available per vendor advisory' and confirm the fixed build against that page. As an immediate compensating control, reinstall the applications to the default system partition (typically the C: drive under %ProgramFiles%) where Windows applies restrictive inherited ACLs, which removes the vulnerable condition entirely; the trade-off is reclaiming disk space on the system volume. If the software must remain on a secondary partition before patching, manually harden the install directory ACLs to remove write/modify rights for standard and Authenticated Users (grant modify only to Administrators/SYSTEM), accepting that a future reinstall or update may reset those permissions and require re-hardening.