Lenovo App Store EUVD-2026-44976

Exploitation requires a local authenticated account on a device running the Chinese-market Lenovo App Store client (AV:L, PR:L), plus user interaction (UI:P) - the victim must be induced to perform an action such as confirming or triggering an install/resource operation that the client then processes. The specific technical prerequisite is that the attacker can supply a file path or package reference containing directory-traversal sequences that the App Store client fails to sanitize, allowing placement or loading of a file outside the intended directory that leads to code execution. Limiting factors: the product is distributed only in the Chinese market (no exposure elsewhere), the attacker cannot act remotely or unauthenticated, and the required user interaction plus pre-existing low-privilege access substantially constrain opportunistic mass exploitation.

The signals are internally consistent and point to a moderate, not critical, real-world priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P) confirms this is a local-only issue: the attacker must already be an authenticated low-privileged user on the machine and must additionally trick a user into an action (UI:P), which meaningfully raises the bar above a remote drive-by. Against that, VC:H/VI:H/VA:H shows a serious technical impact once triggered - full compromise of the local system's data and integrity. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or automated weaponization; per the precision rules this is 'no public exploit identified at time of analysis.' The Chinese-market-only distribution further narrows the exposed population. Net: a legitimately high-impact local privilege/code-execution bug that is gated behind local access and user interaction, making it a patch-in-normal-cycle item rather than an emergency for most global fleets, but higher priority for shared or multi-user Lenovo endpoints in China.

A low-privileged but authenticated user (or malware running in that user's context) on a Chinese-market Lenovo device crafts a package or resource with an embedded traversal path and induces the App Store client to process it, for example by getting the victim to open or confirm a malicious install prompt (UI:P). The traversal writes an executable payload to a location the client later runs, yielding arbitrary code execution on the local host. No public proof-of-concept is currently identified, so this scenario is inferred from the CWE-22 class and the CVSS local/code-execution impact.