Skip to content
Fencer Vulns
medium 6.7

CVE-2025-10238 json

During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products…

published 2026-06-10 4 mo ago modified 2026-10-07 33 d ago also EUVD-2025-210108

cvss
6.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).

Patch / fix

  • Lenovo X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad) BIOS 1.12
  • Lenovo X1 Carbon 13th Gen (Type 21NX, 21NY) Laptops (ThinkPad) BIOS 1.15
  • Lenovo P16v Gen 3 (Type 21RS, 21RT) Laptop (ThinkPad) BIOS BIOS: 1.13 / ECFW: 1.09
  • Lenovo L16 Gen 1 (Type 21L7 21L8) Laptops (ThinkPad) BIOS 1.40
  • Lenovo T14s Gen 6 (Type 21TB, 21TC) Laptops (ThinkPad) BIOS 1.11
  • Lenovo P14s Gen 6 (Type 21QT, 21QU) Laptops (ThinkPad) BIOS UEFI BIOS V1.22/ECP V1.13
  • Lenovo L13 Gen 6 (Type 21RB, 21RC) Laptops (ThinkPad) BIOS 1.15
  • Lenovo L14 Gen 6 (Type 21SE, 21SF) Laptops (ThinkPad) BIOS 1.14
  • Lenovo E16 Gen 3 (Type 22AY, 22B0) Laptop (ThinkPad) BIOS 1.38
  • Lenovo L16 Gen 2 (Type 21SC, 21SD) Laptops (ThinkPad) BIOS 1.13
  • Lenovo X13 Gen 6 (Type 21RM, 21RN) Laptops (ThinkPad) BIOS 1.62/1.12
  • Lenovo T14s Gen 6 (Type 21R1, 21R2) Laptops (ThinkPad) BIOS 1.10
  • Lenovo X1 2-in-1 Gen 9 (Type 21KE, 21KF) Laptop (ThinkPad) BIOS 1.45
  • Lenovo X1 Fold 16 Gen 1 (Type 21ES, 21ET) Laptop (ThinkPad) BIOS 1.25
  • Lenovo Z16 Gen 2 (Type 21JX, 21JY) Laptop (ThinkPad) BIOS 1.37
  • Lenovo P16v Gen 1 (Type 21FE, 21FF) Laptop (ThinkPad) BIOS 1.65/1.13
  • Lenovo X13 Gen 4 (Type 21J3, 21J4) Laptop (ThinkPad) BIOS 1.37
  • Lenovo T14s Gen 4 (Type 21F8, 21F9) Laptop (ThinkPad) BIOS 1.28
  • Lenovo P14s Gen 4 (Type 21K5, 21K6) Laptop (ThinkPad) BIOS 1.47
  • Lenovo P1 Gen 6 (Type 21FV, 21FW) Laptop (ThinkPad) BIOS 1.38
  • Lenovo P16v Gen 1 (Type 21FC, 21FD) Laptop (ThinkPad) BIOS BIOS: 1.40 / ECFW: 1.09
  • Lenovo P16 Gen 2 (Type 21FA, 21FB) Laptop (ThinkPad) BIOS BIOS: 1.61 / ECFW: 1.57
  • Lenovo X13 Yoga Gen 4 (Type 21F2, 21F3) Laptop (ThinkPad) BIOS 1.22
  • Lenovo P16s Gen 2 (Type 21HK, 21HL) Laptop (ThinkPad) BIOS 1.51
  • Lenovo E14 Gen 5 (Type 21JR, 21JS) Laptop (ThinkPad) BIOS 1.29
  • Lenovo T14s Gen 4 (Type 21F6, 21F7) Laptop (ThinkPad) BIOS 1.23
  • Lenovo ThinkPad R14 Gen 5 Type 21JM PRC BIOS 1.41
  • Lenovo L14 Gen 4 (Type 21H1, 21H2) Laptop (ThinkPad) BIOS 1.34
  • Lenovo L13 Gen 4 (Type 21FG, 21FH) Laptop (ThinkPad) BIOS 1.24
  • Lenovo X1 Nano Gen 3 (Type 21K1, 21K2) Laptop (ThinkPad) BIOS 1.28

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

0.12% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Lenovo X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad) BIOS
  • Lenovo X1 Carbon 13th Gen (Type 21NX, 21NY) Laptops (ThinkPad) BIOS
  • Lenovo P16v Gen 3 (Type 21RS, 21RT) Laptop (ThinkPad) BIOS
  • Lenovo L16 Gen 1 (Type 21L7 21L8) Laptops (ThinkPad) BIOS
  • Lenovo T14s Gen 6 (Type 21TB, 21TC) Laptops (ThinkPad) BIOS
  • Lenovo P14s Gen 6 (Type 21QT, 21QU) Laptops (ThinkPad) BIOS
  • Lenovo L13 Gen 6 (Type 21RB, 21RC) Laptops (ThinkPad) BIOS
  • Lenovo L14 Gen 6 (Type 21SE, 21SF) Laptops (ThinkPad) BIOS
  • Lenovo E16 Gen 3 (Type 22AY, 22B0) Laptop (ThinkPad) BIOS
  • Lenovo L16 Gen 2 (Type 21SC, 21SD) Laptops (ThinkPad) BIOS
  • Lenovo X13 Gen 6 (Type 21RM, 21RN) Laptops (ThinkPad) BIOS
  • Lenovo T14s Gen 6 (Type 21R1, 21R2) Laptops (ThinkPad) BIOS
  • Lenovo X1 2-in-1 Gen 9 (Type 21KE, 21KF) Laptop (ThinkPad) BIOS
  • Lenovo X1 Fold 16 Gen 1 (Type 21ES, 21ET) Laptop (ThinkPad) BIOS
  • Lenovo Z16 Gen 2 (Type 21JX, 21JY) Laptop (ThinkPad) BIOS
  • Lenovo P16v Gen 1 (Type 21FE, 21FF) Laptop (ThinkPad) BIOS
  • Lenovo X13 Gen 4 (Type 21J3, 21J4) Laptop (ThinkPad) BIOS
  • Lenovo T14s Gen 4 (Type 21F8, 21F9) Laptop (ThinkPad) BIOS
  • Lenovo P14s Gen 4 (Type 21K5, 21K6) Laptop (ThinkPad) BIOS
  • Lenovo P1 Gen 6 (Type 21FV, 21FW) Laptop (ThinkPad) BIOS
  • Lenovo P16v Gen 1 (Type 21FC, 21FD) Laptop (ThinkPad) BIOS
  • Lenovo P16 Gen 2 (Type 21FA, 21FB) Laptop (ThinkPad) BIOS
  • Lenovo X13 Yoga Gen 4 (Type 21F2, 21F3) Laptop (ThinkPad) BIOS
  • Lenovo P16s Gen 2 (Type 21HK, 21HL) Laptop (ThinkPad) BIOS
  • Lenovo E14 Gen 5 (Type 21JR, 21JS) Laptop (ThinkPad) BIOS
  • Lenovo T14s Gen 4 (Type 21F6, 21F7) Laptop (ThinkPad) BIOS
  • Lenovo ThinkPad R14 Gen 5 Type 21JM PRC BIOS
  • Lenovo L14 Gen 4 (Type 21H1, 21H2) Laptop (ThinkPad) BIOS
  • Lenovo L13 Gen 4 (Type 21FG, 21FH) Laptop (ThinkPad) BIOS
  • Lenovo X1 Nano Gen 3 (Type 21K1, 21K2) Laptop (ThinkPad) BIOS
  • Lenovo S2 Yoga Gen 8 (Types 21FU) China Only Laptop (ThinkPad) BIOS
  • Lenovo L15 Gen 4 (Type 21H7, 21H8) Laptops (ThinkPad) BIOS
  • Lenovo X1 Yoga 8th Gen (Type 21HQ, 21HR) Laptop (ThinkPad) BIOS
  • Lenovo T14s Gen 6 (Type 21M1, 21M2) Laptops (ThinkPad) BIOS
  • Lenovo P15v Gen 3 (Type 21EN 21EM) Laptop (ThinkPad) BIOS
  • Lenovo P16 Gen 1 (Type 21D6, 21D7) Laptop (ThinkPad) BIOS
  • Lenovo X1 2-in-1 Gen 10 (Type 21NU, 21NV) Laptop (ThinkPad) BIOS
  • Lenovo X9-15 Gen 1 (Type 21Q6, 21Q7) Laptop (ThinkPad) BIOS
  • Lenovo X9-14 Gen 1 (Type 21QA, 21QB) Laptop (ThinkPad) BIOS
  • Lenovo T14s Gen 5 (Type 21LS, 21LT) Laptop (ThinkPad) BIOS
  • Lenovo L14 Gen 5 (Type 21L1, 21L2) Laptops (ThinkPad) BIOS
  • Lenovo E14 Gen 6 (Type 21M3, 21M4) Laptops (ThinkPad) BIOS
  • Lenovo E16 Gen 3 (Type 21SR, 21SS) Laptops (ThinkPad) BIOS
  • Lenovo T14 Gen 3 (Type 21AH, 21AJ) Laptop (ThinkPad) BIOS
  • Lenovo T15p Gen 3 (Type 21DA 21DB) Laptop (ThinkPad) BIOS
  • Lenovo P1 Gen 5 (Type 21DC 21DD) Laptop (ThinkPad) BIOS
  • Lenovo T14s Gen 3 (Type 21CQ 21CR) Laptop (ThinkPad) BIOS
  • Lenovo P14s Gen 3 (Type 21J5, 21J6) Laptop (ThinkPad) BIOS
  • Lenovo Z16 Gen 1 (Type 21D4, 21D5) Laptop (ThinkPad) BIOS
  • Lenovo T14s Gen 3 (Type 21BR 21BS) Laptop (ThinkPad) BIOS

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.