CVE-2026-75941
8.0HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-502
Impact
Attackers on the same local network with low-privilege access can execute arbitrary code on the host machine. They require adjacent network access and valid local credentials.
Root cause
Unsafe deserialization of untrusted input (CWE-502) allows malicious payloads to trigger code execution.
Affected systems
Lenovo Legion Zone (China-exclusive market distribution); exact versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Check the vendor advisory (https://iknow.lenovo.com.cn/detail/442627) for the updated installer. Until then, stop and disable the Lenovo Legion Zone application service or isolate affected machines to a segregated VLAN.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.