CVE-2026-4135

MEDIUM

Lenovo Software Fix < 7.5.5.19 - Authenticated Arbitrary File Write via Improper Link Resolution

Title source: llm

Description

During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authenticated user to perform an arbitrary file write with elevated privileges.

References (1)

Core 1

Core References

https://support.lenovo.com/us/en/product_security/LEN-213829

Scores

CVSS v3 6.6

EPSS 0.0012

EPSS Percentile 1.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-59

Status published

Products (1)

Lenovo/Software Fix < 7.5.5.19

Published Apr 15, 2026

Tracked Since Apr 15, 2026