This vulnerability (CVE-2026-9046) affects Lenovo Legion Zone and Lenovo App Store Windows applications distributed in China. When installed on a non-system partition, insecure inherited permissions may allow a local user with limited privileges to execute arbitrary code. The vulnerability is related to improper permission inheritance (CWE-277). The CVSS 4.0 vector indicates local attack vector, low complexity, partial attack type, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

A local attacker with limited privileges could exploit insecure inherited permissions to execute arbitrary code on affected systems, potentially leading to unauthorized actions or system compromise. The impact affects confidentiality, integrity, and availability at a high level. The vulnerability is limited to installations on non-system partitions and to the specific Lenovo applications distributed in the Chinese market.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to systems with these applications installed on non-system partitions and monitor for suspicious local activity related to these applications.