Lenovo One Client DLL Hijacking Vulnerability Allowing Privilege Escalation

A potential DLL hijacking vulnerability has been identified in Lenovo One Client. This vulnerability could allow a local authenticated user to execute code with elevated privileges. The issue was discovered during an internal security assessment.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution with elevated privileges.

Remediation

Lenovo has terminated the One Client service and advises customers to stop using it. For more details, refer to the Lenovo Product Security page. Customers can download the latest version of Lenovo Smart Connect from the Microsoft Store.