CVE-2025-12046
published 2025-12-10CVE-2025-12046: A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
2.7th percentile
A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code with elevated privileges under certain conditions.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lenovo | app_store | < 9.0.2530.1027 | 9.0.2530.1027 |
| lenovo | browser | < 9.0.6.11071 | 9.0.6.11071 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.5HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Lenovo App Store/Browser prior 9.0.2530.1027 uncontrolled search path
vuldb·2026-09-29·CVSS 7.8
CVE-2025-12046 [HIGH] Lenovo App Store/Browser prior 9.0.2530.1027 uncontrolled search path
A vulnerability was found in Lenovo App Store and Browser. It has been declared as problematic. Affected by this issue is some unknown functionality. Such manipulation leads to uncontrolled search path.
This vulnerability is referenced as CVE-2025-12046. The attack can only be performed from a local environment. No exploit is available.
It is recommended to upgrade the affected component.
GHSA
GHSA-82hr-h35p-vq5v: A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to exec
ghsa_unreviewed·2025-12-10
CVE-2025-12046 [HIGH] CWE-427 GHSA-82hr-h35p-vq5v: A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to exec
A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code with elevated privileges under certain conditions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-10
Published