An internal security assessment uncovered that Lenovo Software Fix contains a flaw that permits a local authenticated user to execute arbitrary code with elevated privileges. This weakness, identified as CWE‑88, could enable the attacker to run any commands, modify system settings, or install additional malware, thereby compromising the integrity and confidentiality of the affected system.

Lenovo Software Fix is affected when installed before update version 7.5.5.19. All versions of the product listed under the Lenovo Software Fix family are vulnerable until the stated patch is applied.

The vulnerability scores a CVSS base of 8.5, indicating a high severity. The EPSS indicator is not available, but the lack of a KEV listing suggests no widespread public exploitation reports yet. The attack requires local authenticated access, so the threat is primarily internal; however, once a user gains the necessary module, arbitrary code execution is achievable without additional privilege escalation steps.