CVE-2025-10238

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-10 · updated 2026-10-07
Weakness: CWE-787

Description

During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).

Affected products

Lenovo E14 Gen 4 (type 21E3, 21E4) Laptops (ThinkPad) BIOS: before 1.34 — fixed in 1.34
Lenovo E14 Gen 5 (Type 21JR, 21JS) Laptop (ThinkPad) BIOS: before 1.29 — fixed in 1.29
Lenovo E14 Gen 6 (Type 21M3, 21M4) Laptops (ThinkPad) BIOS: before 1.27 — fixed in 1.27
Lenovo E14 Gen 7 (Type 21T9, 21TA) Laptops (ThinkPad) BIOS: before 1.11 — fixed in 1.11
Lenovo E15 Gen 3 (Type 20YG, 20YH, 20YJ, 20YK) Laptop (ThinkPad) BIOS: before 1.24 — fixed in 1.24
Lenovo E15 Gen 4 (type 21ED 21EE) Laptop (ThinkPad) BIOS: before 1.27 — fixed in 1.27
Lenovo E16 Gen 2 (Type 21MA, 21MB) Laptops (ThinkPad) BIOS: before 1.21 — fixed in 1.21
Lenovo E16 Gen 3 (Type 21SR, 21SS) Laptops (ThinkPad) BIOS: before 1.11 — fixed in 1.11
Lenovo E16 Gen 3 (Type 21ST, 21SU) Laptops (ThinkPad) BIOS: before 1.21 — fixed in 1.21
Lenovo E16 Gen 3 (Type 22AY, 22B0) Laptop (ThinkPad) BIOS: before 1.38 — fixed in 1.38
Lenovo L13 2-in-1 Gen 6 (Type 21R7, 21R8) Laptops (ThinkPad) BIOS: before 1.10 — fixed in 1.10
Lenovo L13 Gen 4 (Type 21FG, 21FH) Laptop (ThinkPad) BIOS: before 1.24 — fixed in 1.24
Lenovo L13 Gen 5 (Type 21LB, 21LC) Laptops (ThinkPad) BIOS: before 1.21 — fixed in 1.21
Lenovo L13 Gen 6 (Type 21RB, 21RC) Laptops (ThinkPad) BIOS: before 1.15 — fixed in 1.15
Lenovo L13 (type 20R3, 20R4) Laptops (ThinkPad) BIOS: before 1.45 — fixed in 1.45
Lenovo L13 Yoga Gen 3 (Type 21B5, 21B6) Laptop (ThinkPad) BIOS: before 1.31 — fixed in 1.31
Lenovo L14 Gen 2 Type 20X1 20X2 Laptops (ThinkPad) BIOS: before 1.73 — fixed in 1.73
Lenovo L14 Gen 2 (type 20X5, 20X6) Laptop (ThinkPad) BIOS: before 1.36 — fixed in 1.36
Lenovo L14 Gen 3 (type 21C1, 21C2) Laptops (ThinkPad) BIOS: before 1.44 — fixed in 1.44
Lenovo L14 Gen 3 (type 21C5, 21C6) Laptops (ThinkPad) BIOS: before 1.36 — fixed in 1.36
Lenovo L14 Gen 4 (Type 21H1, 21H2) Laptop (ThinkPad) BIOS: before 1.34 — fixed in 1.34
Lenovo L14 Gen 5 (Type 21L1, 21L2) Laptops (ThinkPad) BIOS: before 1.24 — fixed in 1.24
Lenovo L14 Gen 6 (Type 21S6, 21S7) Laptops (ThinkPad) BIOS: before 1.06 — fixed in 1.06
Lenovo L14 Gen 6 (Type 21SE, 21SF) Laptops (ThinkPad) BIOS: before 1.14 — fixed in 1.14
Lenovo L15 Gen 4 (Type 21H7, 21H8) Laptops (ThinkPad) BIOS: before 1.27 — fixed in 1.27
Lenovo L16 Gen 1 (Type 21L7 21L8) Laptops (ThinkPad) BIOS: before 1.40 — fixed in 1.40
Lenovo L16 Gen 2 (Type 21SC, 21SD) Laptops (ThinkPad) BIOS: before 1.13 — fixed in 1.13
Lenovo L390 (type 20NR, 20NS) Laptops (ThinkPad) BIOS: before 1.53 — fixed in 1.53
Lenovo P14s Gen 2 (type 21A0, 21A1) Laptop (ThinkPad) BIOS: before 1.33 — fixed in 1.33
Lenovo P14s Gen 3 (Type 21J5, 21J6) Laptop (ThinkPad) BIOS: before 1.63 — fixed in 1.63

How to fix

Upgrade to a fixed version: Lenovo E14 Gen 4 (type 21E3, 21E4) Laptops (ThinkPad) BIOS 1.34; Lenovo E14 Gen 5 (Type 21JR, 21JS) Laptop (ThinkPad) BIOS 1.29; Lenovo E14 Gen 6 (Type 21M3, 21M4) Laptops (ThinkPad) BIOS 1.27; Lenovo E14 Gen 7 (Type 21T9, 21TA) Laptops (ThinkPad) BIOS 1.11; Lenovo E15 Gen 3 (Type 20YG, 20YH, 20YJ, 20YK) Laptop (ThinkPad) BIOS 1.24; Lenovo E15 Gen 4 (type 21ED 21EE) Laptop (ThinkPad) BIOS 1.27; Lenovo E16 Gen 2 (Type 21MA, 21MB) Laptops (ThinkPad) BIOS 1.21; Lenovo E16 Gen 3 (Type 21SR, 21SS) Laptops (ThinkPad) BIOS 1.11; Lenovo E16 Gen 3 (Type 21ST, 21SU) Laptops (ThinkPad) BIOS 1.21; Lenovo E16 Gen 3 (Type 22AY, 22B0) Laptop (ThinkPad) BIOS 1.38; Lenovo L13 2-in-1 Gen 6 (Type 21R7, 21R8) Laptops (ThinkPad) BIOS 1.10; Lenovo L13 Gen 4 (Type 21FG, 21FH) Laptop (ThinkPad) BIOS 1.24. Check the vendor advisory for mitigations.

References

https://support.lenovo.com/us/en/product_security/LEN-218282

Get alerted when CVE-2025-10238 or the next vulnerability affects your stack