The vulnerability is an improper authorization flaw that permits a local user who has authenticated to Lenovo Baiying PC Client to execute arbitrary code with elevated privileges. Exploitation grants the attacker full control of the affected system within the scope of the user’s administrative rights, enabling denial of service, data tampering, or persistence. The weakness is a classic example of CWE-862 where access control checks are insufficient or bypassed.

Lenovo's Baiying PC Client, sold exclusively in the Chinese market, is affected. The affected component is the LenovoBaiyingCommercialAddin, which updates automatically when the client launches. The fix requires upgrading to version 1.1.0.295 or later.

The CVSS base score of 7 indicates moderate to high severity, and the EPSS score of < 1% shows a low probability of exploitation. The attack vector is local; the attacker must be an authenticated user of the client. Because the add‑in updates automatically, the risk persists only until the update is applied. The vulnerability is not listed in CISA’s KEV catalog, so there is no known widespread exploitation. Nonetheless, the combination of local privilege escalation and arbitrary code execution warrants prompt remediation.