What’s Vulnerable › Vulnerabilities

CVE-2022-1891

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-26 · updated 2026-06-17
• Weakness: CWE-122

Description

A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.

Affected products

• Lenovo Thinkbook 14-Iil Firmware: before djcn28ww — fixed in djcn28ww
• Lenovo Thinkbook 14-Iml Firmware: before cjcn38ww — fixed in cjcn38ww
• Lenovo Thinkbook 15-Iil Firmware: before djcn28ww — fixed in djcn28ww
• Lenovo Thinkbook 15-Iml Firmware: before cjcn38ww — fixed in cjcn38ww
• Lenovo Yoga C640-13Iml Firmware: before chcn28ww — fixed in chcn28ww
• Lenovo Yoga C640-13Iml Lte Firmware: before chcn28ww — fixed in chcn28ww

How to fix

Upgrade to a fixed version: Lenovo Thinkbook 14-Iil Firmware djcn28ww; Lenovo Thinkbook 14-Iml Firmware cjcn38ww; Lenovo Thinkbook 15-Iil Firmware djcn28ww; Lenovo Thinkbook 15-Iml Firmware cjcn38ww; Lenovo Yoga C640-13Iml Firmware chcn28ww; Lenovo Yoga C640-13Iml Lte Firmware chcn28ww. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/product_security/LEN-91369
• https://support.lenovo.com/us/en/product_security/LEN-91369

Get alerted when CVE-2022-1891 or the next vulnerability affects your stack