This vulnerability is an input validation flaw in the LenovoProductivitySystemAddin component used by Lenovo Vantage and Lenovo Baiying. A local authenticated user can invoke actions that terminate arbitrary processes running with elevated privileges. Key impact includes the ability to disrupt critical system or security processes, potentially leading to service interruption or denial of service, and could be leveraged as a foothold for privilege escalation. The weakness is classified as CWE‑88, indicating insufficient validation that trusts user input.

The affected products are Lenovo Vantage and Lenovo Baiying, specifically the LenovoProductivitySystemAddin. Versions prior to 1.0.0.138 of the addin are impacted. Users running any earlier release through Lenovo Vantage or Baiying are vulnerable.

The CVSS v3.1 score is 6.8, indicating a moderate severity. EPSS is below 1%, suggesting a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attack requires local authentication; the attacker must be able to access the Vantage or Baiying addin to trigger the process termination. No remote execution vector is disclosed.