Executive brief
A vulnerability in the Lenovo App Store, specifically the version distributed in the Chinese market, could allow a person with physical or local access to a computer to run unauthorized commands. This could result in an attacker gaining full control over the system or accessing sensitive data by escalating their user permissions. Users are advised to update to the latest version of the application to mitigate this risk.
Technical details
A privilege escalation vulnerability exists in the Lenovo App Store (distributed in China) due to the application executing processes with unnecessary privileges (CWE-250). A local authenticated attacker with low-level permissions can exploit this flaw to execute arbitrary code with the higher privileges of the application. The attack requires local access and some degree of user interaction. Lenovo has addressed this in version 9.0.2930.0514 and later.
Affected products
- Lenovo App Store (China Market) versions prior to 9.0.2930.0514
Timeline
- 2026-07-16: disclosed: Initial advisory publication