Vulnerability · Published Jan 14, 2025 · Assigned by lenovo

CVE-2024-10253

Medium 4.7

In plain English

A medium-severity heap buffer overflow in App Store from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.1%top 97.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.

Affected products (as reported)

Vendor	Product	Versions
Lenovo	PC Manager	0 – before 5.1.90.12092
Lenovo	Browser	0 – before 9.0.5.12181
Lenovo	App Store	0 – before 9.0.20

Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://iknow.lenovo.com.cn/detail/425367