CVE-2024-3100

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-13 · updated 2026-06-17
Weakness: CWE-121

Description

A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated privileges to execute arbitrary code.

Affected products

Lenovo 100W Gen 4 Firmware: before l2cn34ww; before l3cn34ww — fixed in l2cn34ww, l3cn34ww
Lenovo 13W Yoga Firmware: before jacn41ww — fixed in jacn41ww
Lenovo 13W Yoga Gen 2 Firmware: before kbcn29ww — fixed in kbcn29ww
Lenovo 14W Gen 2 Firmware: before h0cn29ww — fixed in h0cn29ww
Lenovo 300W Gen 3 Firmware: before gacn48ww — fixed in gacn48ww
Lenovo Flex 7 14Iau7 Firmware: before j7cn48ww — fixed in j7cn48ww
Lenovo Flex 7 14Iru8 Firmware: before l6cn24ww — fixed in l6cn24ww
Lenovo Ideapad 1-14Igl05 Firmware: before dwcn31ww — fixed in dwcn31ww
Lenovo Ideapad 5-15Alc05 Firmware: before h2cn35ww — fixed in h2cn35ww
Lenovo Ideapad 5-15Itl05 Firmware: before fxcn47ww — fixed in fxcn47ww
Lenovo Ideapad Flex 5 14Abr8 Firmware: before l7cn21ww — fixed in l7cn21ww
Lenovo Ideapad Flex 5 16Alc7 Firmware: before jccn40ww — fixed in jccn40ww
Lenovo Ideapad Slim 3 14Abr8 Firmware: before kycn32ww — fixed in kycn32ww
Lenovo Ideapad Slim 5 Light 14Abr8 Firmware: before l9cn26ww — fixed in l9cn26ww
Lenovo Thinkbook 13S G4 Arb Firmware: before hzcx55ww — fixed in hzcx55ww
Lenovo Thinkbook 13S G4 Iap Firmware: before hwcn52ww — fixed in hwcn52ww
Lenovo Thinkbook 13X G2 Iap Firmware: before hxcn57ww — fixed in hxcn57ww
Lenovo Thinkbook 14 G6 Abp Firmware: before mncn27ww — fixed in mncn27ww
Lenovo Thinkbook 14 G6 Irl Firmware: before mmcn36ww — fixed in mmcn36ww
Lenovo V14 G2-Alc Firmware: before glcn63ww — fixed in glcn63ww
Lenovo V14 G4 Abp Firmware: before mscn16ww — fixed in mscn16ww
Lenovo V14 G4 Amn Firmware: before l1cn41ww — fixed in l1cn41ww
Lenovo V15 G3 Aba Firmware: before jtcn54ww — fixed in jtcn54ww
Lenovo Yoga Slim 7 Pro-14Ach5 Firmware: before gzcn36ww — fixed in gzcn36ww

How to fix

Upgrade to a fixed version: Lenovo 100W Gen 4 Firmware l2cn34ww, l3cn34ww; Lenovo 13W Yoga Firmware jacn41ww; Lenovo 13W Yoga Gen 2 Firmware kbcn29ww; Lenovo 14W Gen 2 Firmware h0cn29ww; Lenovo 300W Gen 3 Firmware gacn48ww; Lenovo Flex 7 14Iau7 Firmware j7cn48ww; Lenovo Flex 7 14Iru8 Firmware l6cn24ww; Lenovo Ideapad 1-14Igl05 Firmware dwcn31ww; Lenovo Ideapad 5-15Alc05 Firmware h2cn35ww; Lenovo Ideapad 5-15Itl05 Firmware fxcn47ww; Lenovo Ideapad Flex 5 14Abr8 Firmware l7cn21ww; Lenovo Ideapad Flex 5 16Alc7 Firmware jccn40ww. Check the vendor advisory for mitigations.

References

https://support.lenovo.com/us/en/product_security/LEN-165524

Get alerted when CVE-2024-3100 or the next vulnerability affects your stack