CVE-2026-92629
7.3HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-862
Impact
A local authenticated attacker can execute arbitrary code with elevated privileges on target machines. They require an existing local account and user interaction to trigger it.
Root cause
Improper authorization checks in the Lenovo Baiying PC Client allow local users to perform unauthorized privileged operations.
Affected systems
Lenovo Baiying PC Client (versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to the latest patched version specified in Lenovo advisory 442628. If patching must wait, stop or uninstall the Lenovo Baiying PC Client software on affected endpoints.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.