The vulnerability exists in Lenovo Software Fix and allows a local authenticated user to perform an arbitrary file write with elevated privileges during the installation process. This file write flaw, classified as CWE‑59, means an attacker could overwrite critical system files or binaries, potentially leading to privilege escalation or a full compromise of the affected machine. The impact is primarily an integrity and confidentiality breach where unauthorized changes could enable malicious code execution.

The affected product is Lenovo Software Fix from Lenovo. Any installation that falls below the patched version 7.5.5.19 is vulnerable; upgrading to 7.5.5.19 or later resolves the issue. No specific sub‑versions were enumerated, so all older builds lacking the patch should be considered at risk.

The CVSS base score of 5.2 indicates a medium severity threat; the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attack surface is limited to local and authenticated users who can trigger an installer run. Because the flaw allows elevated file writes, exploitation requires local administrative access, making widespread use unlikely, yet the flaw remains dangerous if leveraged for privilege escalation.