Legion Zone CVE-2026-9046

Exploitation requires that Legion Zone or the Lenovo App Store was installed on a NON-system partition (not the default system drive) - this is the concrete configuration prerequisite that creates the world-writable, insecurely-inherited directory permissions (CWE-277). The attacker must already have a local, low-privileged account on the machine (CVSS PR:L, AV:L), and no user interaction is needed (UI:N). Limiting factors: it cannot be triggered remotely, standard-installations on the system partition are not affected (matching the AT:P Attack Requirement), and exposure is further constrained to the Chinese-market distribution of these two Lenovo applications. It is not exploitable against default install locations.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N, VC:H/VI:H/VA:H) scores 7.3 (High) and paints a consistent picture: exploitation is local, requires an existing low-privilege account (PR:L), and carries an Attack Requirement (AT:P) - the software must be installed on a non-system partition, a non-default deployment. Confidentiality, integrity, and availability impacts are all High once code executes. There is no EPSS score, no POC, and no SSVC record supplied; the CVE is not in CISA KEV, so there is no evidence of active exploitation. The practical risk is therefore moderate and conditional: the AT:P requirement and PR:L requirement meaningfully limit exposure, so this is a legitimate local-privilege/code-execution issue for a specific configuration rather than a broadly wormable or remotely reachable threat. No conflicting signals were observed, but the absence of EPSS/POC data means exploitability in practice is inferred from the vector, not measured.

On a Lenovo Windows PC where Legion Zone or the Lenovo App Store was installed to a non-system drive (e.g. D:\), a standard local user replaces or drops a malicious executable/DLL in the world-writable application directory. When the application, its updater, or an associated service next launches or loads that component under a higher-privileged context, the attacker's code runs, achieving arbitrary code execution. No public POC is currently identified.