CVE-2026-4134 describes an uncontrolled search path element vulnerability (CWE-427) in Lenovo Software Fix. During installation, the software may use insecure search paths that allow a local authenticated user to execute arbitrary code with elevated privileges. The CVSS 4.0 base score is 7.0 (high), reflecting that the attack vector is local, with low attack complexity, requiring user interaction, and privileges at the user level. The vulnerability does not involve network access or system compromise without local access. No patch or official remediation level has been published by Lenovo as of the data provided.

If exploited, a local authenticated user could gain elevated privileges on the affected system by leveraging the uncontrolled search path during installation. This could lead to unauthorized code execution with higher privileges than the user originally possesses. There are no reports of active exploitation in the wild, and the vulnerability requires local access and user interaction.

Patch status is not yet confirmed — check the Lenovo vendor advisory for current remediation guidance. Until an official fix is released, limit local user access to trusted users only and exercise caution during installation processes. Monitor Lenovo advisories for updates on patches or mitigations.