A critical security vulnerability has been discovered in Lenovo’s protection driver software, affecting millions of users across desktop and laptop systems.
The flaw, identified as CVE-2025-4657, allows local attackers with elevated privileges to execute arbitrary code through a buffer overflow exploit, posing significant security risks to enterprise and consumer environments.
The security advisory LEN-195370, published on July 8, 2025, reveals that Lenovo Protection Driver versions prior to 5.1.110.4231 contain a dangerous buffer overflow vulnerability.
This flaw specifically affects three key Lenovo applications: Lenovo PC Manager, Lenovo Browser, and Lenovo App Store, which collectively represent core software components used by millions of users worldwide.
The vulnerability enables privilege escalation attacks, where malicious actors can gain unauthorized administrative access to affected systems.
Once exploited, attackers can execute arbitrary code with elevated privileges, potentially allowing them to install malware, access sensitive data, or completely compromise system integrity.
| Attribute | Details |
| CVE ID | CVE-2025-4657 |
| Advisory ID | LEN-195370 |
| Severity | Critical |
| Attack Vector | Local |
| Impact | Privilege Escalation, Code Execution |
| Affected Component | Lenovo Protection Driver |
| Vulnerable Versions | < 5.1.110.4231 |
| File Location | C:\Windows\System32\drivers\lrtp.sys |
The vulnerability impacts a broad range of Lenovo devices, including ThinkPad laptops, ThinkCentre desktops, and other consumer desktop systems.
The affected applications span critical user-facing software components that many users interact with daily.
Users can verify their system’s vulnerability status by navigating to the Windows System32 drivers directory and checking the file version of lrtp.sys.
This can be accomplished by right-clicking the file, selecting Properties, then Details, and examining the file version information.
Lenovo has released security patches to address this vulnerability across all affected applications.
Users should immediately update their Lenovo PC Manager to version 5.1.110.5082 or higher, Lenovo Browser to version 9.0.6.5061 or higher, and Lenovo App Store to version 9.0.2230.0617 or higher.
The company emphasizes that the Lenovo Protection Driver will automatically update when these applications are launched, streamlining the patching process.
However, users should proactively verify that updates have been successfully applied to ensure their systems remain protected.
This vulnerability underscores the critical importance of maintaining up-to-date security patches, particularly for system-level drivers that operate with elevated privileges.
Organizations using Lenovo systems should prioritize immediate patching and consider implementing additional monitoring for unusual system behavior during the transition period.
Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…