Lenovo Software Fix contains a flaw in its installation process that allows a local authenticated user to run code with elevated privileges. Because the installation function is executed with administrative rights, an attacker can execute arbitrary commands during setup, resulting in the potential acquisition of full system control and the ability to read, modify, or delete files and configurations.

All installations of Lenovo Software Fix older than version 7.5.5.19 are vulnerable, regardless of operating system, as the issue was identified during an internal security assessment and applies to deployments where local users can run the installer.

The CVSS score of 7 indicates high severity. No public evidence of exploitation exists, and the exploitability is limited to users with local authenticated access to install the software; therefore the attack vector is local. Although the EPSS score is unavailable, the high CVSS and local nature of the vulnerability warrant timely patching to prevent privilege escalation.