Local privilege escalation via uncontrolled search path

Uncontrolled search path flaws in Lenovo Universal Device Client before 23.10 allow local users to execute code with elevated privileges. Lenovo has not disclosed which executable or library lookup uses an attacker-controlled directory, only that an incomplete earlier fix left the search path uncontrolled. Local low-privileged access is required, and successful exploitation runs attacker-supplied code with the service's elevated privileges.