Local privilege escalation via modifiable registry locations

Improper validation in Lenovo Vantage and Commercial Vantage allows local users to execute code with elevated permissions. Specific registry values accept attacker-controlled modifications without adequate validation before a privileged operation uses them. Exploitation requires local low-privileged access and is limited to elevating code execution on the same Windows system; Lenovo has not disclosed the registry paths or consuming operation.