This vulnerability (CVE-2026-18994) is classified as CWE-926 (Improper Export of Android Application Components) in the Lenovo File Manager Android Application. It allows a local authenticated user to bypass proper authorization controls and access or modify protected files within the application. The affected versions are all versions prior to 9.8.1.77. The CVSS 4.0 score is 8.4 (high), reflecting local attack vector with low complexity, no user interaction, and high impact on confidentiality and integrity. The application is distributed exclusively in the Chinese market. No vendor advisory or patch information is provided, and no known exploits are reported.

A local authenticated user can read or modify protected files within the Lenovo File Manager application, potentially compromising the confidentiality and integrity of sensitive data managed by the app. The impact is rated high due to the ability to access or alter protected files without proper authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit local access to trusted users only and monitor for suspicious activity related to the application. No official patch or workaround information is currently provided.