CVE-2025-43491 is a critical (CVSS 9.8) vulnerability in the Poly Lens Desktop application on Windows. Filesystem modification could lead to SYSTEM level privileges. The record gives no version numbers, so read HP security bulletin HPSBPY04048 for the affected and fixed builds and update every install.
What's affected
The record names HP Poly Lens Desktop running on Windows. Its description is short: the application might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted.
The record does not list affected or fixed version numbers, and I could not retrieve the vendor bulletin while preparing this post. The bulletin it points to is HP security bulletin HPSBPY04048. Read it for the exact builds, rather than relying on a number repeated by a third party.
The score is unusually high for a local style description. The vector in the record lists network attack path, no privileges required and no user interaction, so read the bulletin to see how HP characterises the attack path before you decide how urgent it is for your fleet.
How to check if you're exposed
On Windows, list the installed copies of the application. From PowerShell, a query of the uninstall registry keys with a filter on the display name Poly Lens will show the version on each machine. Repeat it for the 32 bit registry path as well, since installers differ.
For a fleet, pull the same data from your endpoint management or software inventory tool, and group it by version. Compare the result with the fixed build in the HP bulletin.
Also note which machines are shared or used by people with limited rights, such as meeting room systems and kiosks. A flaw that gives SYSTEM from filesystem changes matters most where untrusted users have a session.
What to do now
- Inventory every Windows machine that runs Poly Lens Desktop.
- Open HP bulletin HPSBPY04048 and note the fixed version.
- Update the application through your normal software deployment tool, starting with shared and meeting room machines.
- Confirm the new version on a sample of machines after rollout.
- Review who can write to the application's install and data folders, and remove write access for ordinary users where the product allows.
- Add the product to your software inventory so the next advisory is easy to match.
Why it matters
The weakness is classed as CWE-99 (Improper Control of Resource Identifiers). In plain terms, something in the application trusts a file system location or resource name that a lower privileged user can influence. When the program that reads it runs as SYSTEM, the user can end up executing with the same level.
Local privilege escalation bugs in desktop agents are common, and they matter because the agent runs on many machines at once. The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. The case for fast patching is the combination of a very high score and a widely deployed, always installed collaboration tool.
Quick check
Does the record say which version fixes it?
No. It names the product and platform only. HP bulletin HPSBPY04048 is the document to read for affected and fixed builds.
Is it exploited in the wild?
The record does not say so, and the CVE is not on the CISA Known Exploited Vulnerabilities list.
Sources
Last reviewed: 18 October 2026.
