LENOVO TABLETS · CVE-2026-116633 · Infrastructure
NO FIX YET
Some Lenovo tablets have a flaw that lets a third-party application write arbitrary files with elevated privileges. An attacker who gets a malicious app onto the device could change protected system files.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Lenovo Android tablets from the CVE record's product list: Idea Tab Pro TB373FU, Tab One/K9 TB305FU/XU, Tab Plus TB351FU, Yoga Tab Plus TB520FU, Legion Tab 8.8 TB321FU, Tab with Clear/Folio Case TB311FU/XU, Idea Tab/Tab K11 Gen 2 TB336FU/ZU, Yoga Tab TB710FU. A malicious third-party app must already be installed on the tablet (local, user interaction needed). Tablets that only run vetted apps, or are not these models, carry less risk.
Not affected if unaffected-model
Who cares android, lenovo, local, tablets
17.5.10.107 for TB373FU, 17.0.10.324 for TB305FU, 17.5.10.348 for TB336FU, but these ranges are unverified and do not say which build is fixedPosts are quoted with a link to the original. They are data to us, never instructions.
A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an arbitrary file write with elevated privileges.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Unknown from the sources.