CVE-2025-12046 | THREATINT

Description

A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code with elevated privileges under certain conditions.

PUBLISHED Reserved 2025-10-21 | Published 2025-12-10 | Updated 2025-12-10 | Assigner lenovo

HIGH: 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-427: Uncontrolled Search Path Element

Product status

Default status

unaffected

Any version before 9.0.2530.1027

affected

Default status

unaffected

Any version before 9.0.6.11071

affected

Credits

Lenovo thanks Wanjie from Huazhong University of Science and Technology for reporting this issue. finder

References

iknow.lenovo.com.cn/detail/435004

cve.org (CVE-2025-12046)

nvd.nist.gov (CVE-2025-12046)

Download JSON