Lenovo App Store vulnerabilities

11 CVEs affecting Lenovo App Store, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-9046, published 2026-07-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-10495, published 2025-11-12. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker…
CVE-2026-13103, published 2026-07-16. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code.
CVE-2025-4657, published 2025-07-17. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Lenovo Browser, and Lenovo App Store could allow a local…
CVE-2024-4130, published 2024-10-11. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges.
CVE-2026-13104, published 2026-07-16. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated…
CVE-2023-6450, published 2024-01-19. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of service.
CVE-2025-12046, published 2025-12-10. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code with elevated privileges under certain…
CVE-2025-8485, published 2025-11-12. High severity, CVSS 7.3. EPSS: 0.1% chance of exploitation in the next 30 days. An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application.
CVE-2024-10254, published 2025-01-14. Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days. A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.
CVE-2026-9046, published 2026-07-16. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a…

Latest

CVE-2024-10253, published 2025-01-14. Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days. A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.