Lenovo Tablets EUVD-2026-102538

Exploitation requires that the attacker have PHYSICAL possession of the Lenovo tablet AND that the device be in an UNLOCKED state (past the lock screen) at the time of attack - these are the explicit, limiting preconditions stated in the description and confirmed by the CVSS 4.0 AV:P metric. There is no remote or network path. Exploitation is further limited to the enumerated affected Lenovo tablet models (e.g., Idea Tab Pro TB373FU, Tab K11 Gen 2 TB336FU/ZU, Legion Tab TB321FU, Tab M11 TB330FU/XU, Tab Extreme TB570FU/ZU, Tab K11 TB330FUP) running vulnerable firmware; a locked or powered-off device, or a patched unit, is not exploitable via this flaw.

This is a MEDIUM-severity issue (CVSS 4.0 base 5.4) whose real-world risk is tightly bounded by its physical attack vector. The CVSS 4.0 vector (AV:P/AC:L/AT:P/PR:N/UI:N) confirms exploitation requires PHYSICAL access to the device, and the description further narrows this to a tablet that is already UNLOCKED - so the attacker must have the device in hand and past the lock screen. While the impact triad is high (VC:H/VI:H/VA:H, arbitrary code execution and a bypass of device protections), the physical precondition makes mass or remote exploitation impossible. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public POC was provided, so there is no public exploit identified at time of analysis. The RCE tag in the metadata is inconsistent with the AV:P physical vector - this is a local/physical code-execution issue, not a network-remote one, which materially lowers its priority versus a true RCE. Bottom line: this is a lost/stolen-device and evil-maid concern (and relevant to forensic/data-at-rest threat models, consistent with CWE-1394 'Use of Default Cryptographic Key'), not an internet-facing emergency. Patch on a normal cadence; prioritize for high-risk users whose devices are frequently lost, seized, or left unattended unlocked.

An attacker who obtains a target's unlocked Lenovo tablet (e.g., momentarily unattended, borrowed, or an 'evil maid' scenario) leverages a weakness in the device's protection mechanism - plausibly a default/predictable cryptographic key per CWE-1394 - to bypass built-in safeguards and run arbitrary code on the device. No public exploit code was identified in the provided data, so this remains a theoretical/vendor-reported risk. Because physical possession of an unlocked unit is mandatory, the scenario does not scale beyond opportunistic or targeted physical access.