CVE-2025-10238 | THREATINT

Description

During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).

PUBLISHED Reserved 2025-09-10 | Published 2026-06-10 | Updated 2026-06-10 | Assigner lenovo

HIGH: 8.4CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

MEDIUM: 6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-787: Out-of-bounds Write

Product status

Default status

unaffected

Any version before 1.12

affected

Default status

unaffected

Any version before 1.15

affected

Default status

unaffected

Any version before BIOS: 1.13 / ECFW: 1.09

affected

Default status

unaffected

Any version before 1.40

affected

Default status

unaffected

Any version before 1.11

affected

Default status

unaffected

Any version before UEFI BIOS V1.22/ECP V1.13

affected

Default status

unaffected

Any version before 1.15

affected

Default status

unaffected

Any version before 1.14

affected

Default status

unaffected

Any version before 1.38

affected

Default status

unaffected

Any version before 1.13

affected

Default status

unaffected

Any version before 1.62/1.12

affected

Default status

unaffected

Any version before 1.10

affected

Default status

unaffected

Any version before 1.45

affected

Default status

unaffected

Any version before 1.25

affected

Default status

unaffected

Any version before 1.37

affected

Default status

unaffected

Any version before 1.65/1.13

affected

Default status

unaffected

Any version before 1.37

affected

Default status

unaffected

Any version before 1.28

affected

Default status

unaffected

Any version before 1.47

affected

Default status

unaffected

Any version before 1.38

affected

Default status

unaffected

Any version before BIOS: 1.40 / ECFW: 1.09

affected

Default status

unaffected

Any version before BIOS: 1.61 / ECFW: 1.57

affected

Default status

unaffected

Any version before 1.22

affected

Default status

unaffected

Any version before 1.51

affected

Default status

unaffected

Any version before 1.29

affected

Default status

unaffected

Any version before 1.23

affected

Default status

unaffected

Any version before 1.41

affected

Default status

unaffected

Any version before 1.34

affected

Default status

unaffected

Any version before 1.24

affected

Default status

unaffected

Any version before 1.28

affected

Default status

unaffected

Any version before 1.28

affected

Default status

unaffected

Any version before 1.27

affected

Default status

unaffected

Any version before 1.37

affected

Default status

unaffected

Any version before 1.62/1.12

affected

Default status

unaffected

Any version

affected

Default status

unaffected

Any version before 1.69

affected

Default status

unaffected

Any version before 1.39

affected

Default status

unaffected

Any version before 1.17

affected

Default status

unaffected

Any version before 1.21

affected

Default status

unaffected

Any version before 1.14

affected

Default status

unaffected

Any version before 1.24

affected

Default status

unaffected

Any version before 1.27

affected

Default status

unaffected

Any version before 1.11

affected

Default status

unaffected

Any version before 1.45/1.25

affected

Default status

unaffected

Any version before 1.67

affected

Default status

unaffected

Any version before 1.29

affected

Default status

unaffected

Any version before 1.51

affected

Default status

unaffected

Any version before 1.63

affected

Default status

unaffected

Any version before 1.76

affected

Default status

unaffected

Any version before 1.48

affected

Default status

unaffected

Any version before 1.44

affected

Default status

unaffected

Any version before 1.25

affected

Default status

unaffected

Any version before 1.31

affected

Default status

unaffected

Any version before 1.34

affected

Default status

unaffected

Any version before 1.32

affected

Default status

unaffected

Any version before 1.27

affected

Default status

unaffected

Any version

affected

Default status

unaffected

Any version before 1.52

affected

Default status

unaffected

Any version before 1.36

affected

Default status

unaffected

Any version before 1.38/1.36

affected

Default status

unaffected

Any version before 1.75

affected

Default status

unaffected

Any version before 1.24

affected

Default status

unaffected

Any version before 1.51

affected

Default status

unaffected

Any version before 1.64

affected

Default status

unaffected

Any version before 1.36

affected

Default status

unaffected

Any version before 1.97

affected

Default status

unaffected

Any version before 1.36

affected

Default status

unaffected

Any version before 1.83

affected

Default status

unaffected

Any version before 1.33

affected

Default status

unaffected

Any version

affected

Default status

unaffected

Any version before 1.33

affected

Default status

unaffected

Any version before 1.97

affected

Default status

unaffected

Any version before 1.37

affected

Default status

unaffected

Any version before 1.68

affected

Default status

unaffected

Any version

affected

Default status

unaffected

Any version before 1.21

affected

Default status

unaffected

Any version before 1.17

affected

Default status

unaffected

Any version before 1.73

affected

Default status

unaffected

Any version before 1.21

affected

Default status

unaffected

Any version before 1.10

affected

Default status

unaffected

Any version before 1.08

affected

Default status

unaffected

Any version before 1.69/1.21

affected

Default status

unaffected

Any version before 1.34

affected

Default status

unaffected

Any version before 1.37

affected

Default status

unaffected

Any version before 1.37

affected

Default status

unaffected

Any version before 1.34

affected

Default status

unaffected

Any version before 1.57

affected

Default status

unaffected

Any version before 1.41

affected

Default status

unaffected

Any version before 2.05

affected

Default status

unaffected

Any version before 1.66/1.55

affected

Default status

unaffected

Any version before 1.87/1.32

affected

Default status

unaffected

Any version before 2.01

affected

Default status

unaffected

Any version before 1.85/1.26

affected

Default status

unaffected

Any version before 1.55

affected

Default status

unaffected

Any version before 1.53

affected

Default status

unaffected

Any version before 1.45

affected

Default status

unaffected

Any version before 1.21

affected

Default status

unaffected

Any version before 1.11

affected

Default status

unaffected

Any version before 1.17

affected

Default status

unaffected

Any version before 1.10

affected

Default status

unaffected

Any version before 1.06

affected

Default status

unaffected

Any version before 1.14

affected

Default status

unaffected

Any version before 1.17

affected

Default status

unaffected

Any version before 1.26

affected

Default status

unaffected

Any version before 1.18

affected

Default status

unaffected

Any version before 1.21

affected

Default status

unaffected

Any version before 1.16

affected

Default status

unaffected

Any version before 1.18

affected

References

support.lenovo.com/us/en/product_security/LEN-218282 vendor-advisory

cve.org (CVE-2025-10238)

nvd.nist.gov (CVE-2025-10238)

Download JSON