Lenovo App Store vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Lenovo App Store: 6 record(s), with affected versions and fixes.cpe:2.3:a:lenovo:app_store
CVE-2026-9046
High · 7.0
CWE-277 Jul 16, 2026
A potential insecure permissions vulnerability was reported in Legion Zone and the…
A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrary code.
CVE-2026-13104
High · 7.3
CWE-250 Jul 16, 2026
Execution with Unnecessary Privileges in Lenovo App Store
A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.
CVE-2026-13103
High · 7.3
CWE-22 Jul 16, 2026
Path Traversal in Lenovo App Store
A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code.
CVE-2025-12046
High · 7.8
CWE-427 Dec 10, 2025
Uncontrolled Search Path Element in Lenovo App Store
A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code with elevated privileges under certain conditions.
CVE-2025-8485
High · 7.3
CWE-276 Nov 12, 2025
Incorrect Default Permissions in Lenovo App Store
An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application.
CVE-2025-10495
High · 7.5
CWE-295 Nov 12, 2025
Improper Certificate Validation in Lenovo App Store
A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code.