CVE-2026-92777

MediumCVSS 6.4/10Last modified Oct 16, 2026

Description

A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1394

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LenovoIdea Tab Pro (TB373FU)< 17.5.10.057
LenovoIdea Tab/ Lenovo Tab K11 Gen 2 (TB336FU)< 17.5.10.193
LenovoIdea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU)< 17.5.10.213
LenovoIdea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU)< 17.5.10.210
LenovoLegion Tab (8.8", 3) (TB321FU)< 17.5.10.170
LenovoTab M11 (TB330FU)< 17.0.135
LenovoTab M11 (TB330XU)< 17.0.517
LenovoTab Extreme (TB570FU)< 17.5.382
LenovoTab Extreme (TB570ZU/TB570FU)< 17.5.382
LenovoTab K11 (TB330FUP)< 17.0.135
LenovoTab K11 (TB330XUP)< 17.0.157
LenovoTab K11 Plus (TB352FU)< 17.0.10.296
LenovoTab K11 Plus (TB352XU)< 17.0.10.284
LenovoTab K11 Plus LTE ROW (TB352XU)< 17.0.10.284
LenovoTab K11 Plus WIFI ROW: TB352FU< 17.0.10.296
LenovoTab M10 5G (TB360ZU)< 16.0.935
LenovoTab K9 (TB305FU)< 17.0.10.216
LenovoTab K9 (TB305XU)< 17.0.10.129
LenovoTab One (TB305FU)< 17.0.10.216
LenovoTab One (TB305XU)< 17.0.10.129
LenovoTab P12 (TB370FU)< 17.0.280
LenovoTab Plus (TB351FU)< 17.5.10.199
LenovoTab with Clear Case/ Lenovo Tab with Folio Case (TB311FU)< 17.5.36.302
LenovoLenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU)< 17.5.36.302
LenovoTab with Clear Case/ Lenovo Tab with Folio Case (TB311XU)< 17.5.37.216
LenovoYoga Tab (TB710FU)< 17.5.04.059
LenovoYoga Tab Plus (TB520FU)< 17.5.10.309

References

Timeline

Published
Oct 16, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-927785.4CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the featuCVE-2026-927797.6Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that prCVE-2026-92785.4The Form Builder CP WordPress plugin before 1.2.47 does not properly sanitize a form configuration value before storing it and using it as pCVE-2026-927808.8KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protCVE-2026-927816.3Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes CVE-2026-927828.1Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access cCVE-2026-927838.1Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to deleteCVE-2026-927847.5@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controCVE-2026-927858.1Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. UnauthenticCVE-2026-927867.8LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds meCVE-2026-927879.8Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based accCVE-2026-927888.8Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authentic
CVE-2026-92777: Medium severity, CVSS 6.4 | Vulnix