CVE-2025-10495

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Lenovo	App Store	< 9.0.2530.1027
Lenovo	PC Manager	< 5.1.140.9262
Lenovo	Browser	< 9.0.6.9111
Lenovo	Legion Zone	< 2.0.21

References

https://iknow.lenovo.com.cn/detail/434328

Timeline

Published: Nov 12, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-104967.2The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, CVE-2025-104977.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 t CVE-2025-104985.4The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions CVE-2025-104994.3The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versi CVE-2025-10508.8Sonos Era 300 Out-of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbit CVE-2025-105008.8Use after free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a craft CVE-2025-105018.8Use after free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a cra CVE-2025-105028.8Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via CVE-2025-105036.1The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper outpu CVE-2025-105046.1Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.CVE-2025-10518.8Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execut CVE-2025-10528.8Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exe