Lenovo Service Bridge EUVD-2026-22919

Exploitation requires a local, authenticated user session on a Windows system running Lenovo Service Bridge prior to version 5.0.2.20. The CVSS 4.0 AT:P metric indicates a specific attack precondition: the attacker must have write access to at least one directory in the DLL search path that the application resolves before the legitimate library location. Additionally, UI:P indicates that user interaction or a process trigger is required to cause Service Bridge to load the DLL. Exploitation is not remotely automatable (SSVC: automatable=no). Exploitation is limited by: requirement for an existing authenticated local session, need to write to a specific search-path directory (not universally writable), need to trigger a load event, and the local-only attack vector. Remote, unauthenticated, or network-based exploitation is not possible based on the available vector.

The CVSS 4.0 base score of 5.4 (Medium) accurately reflects real-world constraints: local-only access (AV:L), specific attack preconditions (AT:P, meaning writable path in the DLL search order), low-privilege authenticated user (PR:L), and user interaction required (UI:P). Despite SSVC rating technical impact as 'total' due to VC:H/VI:H/VA:H on the vulnerable system, that rating captures the worst-case post-exploitation outcome rather than exploitability. SSVC also confirms exploitation is 'none' and the attack is not automatable, consistent with the local, interaction-dependent prerequisites. EPSS at 0.01% (2nd percentile) confirms no observed exploitation activity. Even a mid-sized municipal IT team in tczew would be justified in treating this as a routine patch cycle item rather than emergency response, given that an attacker must already hold an authenticated local session and write access to a specific search-path directory before any exploitation is possible. No KEV listing and no public exploit code further reduce urgency beyond the CVSS technical impact.

A local authenticated user with write access to a directory in Lenovo Service Bridge's DLL search path places a malicious DLL named after a library the application loads. When a privileged Service Bridge process is subsequently triggered - for instance, during a support session or diagnostic scan - the application resolves and loads the attacker's DLL first, executing arbitrary code with the elevated privileges of the Service Bridge process. No public exploit code has been identified at time of analysis.