Buffer overflow in Lenovo E14 Gen 4 (Type 21e3, 21e4) Laptops (Thinkpad) Bios
CVE-2025-10238
During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).
Vulnerability class: Buffer Overflow
EPSS: 0.001 (2.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Lenovo E14 Gen 4 (Type 21e3, 21e4) Laptops (Thinkpad) Bios — versions 0
- Lenovo E14 Gen 5 (Type 21jr, 21js) Laptop (Thinkpad) Bios — versions 0
- Lenovo E14 Gen 6 (Type 21m3, 21m4) Laptops (Thinkpad) Bios — versions 0
- Lenovo E14 Gen 7 (Type 21t9, 21ta) Laptops (Thinkpad) Bios — versions 0
- Lenovo E15 Gen 3 (Type 20yg, 20yh, 20yj, 20yk) Laptop (Thinkpad) Bios — versions 0
- Lenovo E15 Gen 4 (Type 21ed 21ee) Laptop (Thinkpad) Bios — versions 0
- Lenovo E16 Gen 2 (Type 21ma, 21mb) Laptops (Thinkpad) Bios — versions 0
- Lenovo E16 Gen 3 (Type 21sr, 21ss) Laptops (Thinkpad) Bios — versions 0
- Lenovo E16 Gen 3 (Type 21st, 21su) Laptops (Thinkpad) Bios — versions 0
- Lenovo E16 Gen 3 (Type 22ay, 22b0) Laptop (Thinkpad) Bios — versions 0
Weakness classification (CWE)
References
- psirt@lenovo.com (vendor-advisory)
Frequently asked questions
- What is CVE-2025-10238?
- CVE-2025-10238 is a medium-severity vulnerability in Lenovo E14 Gen 4 (Type 21e3, 21e4) Laptops (Thinkpad) Bios, classified under Out-of-bounds Write. CVSS score: 6.7/10. Published 2026-06-10.
- How severe is CVE-2025-10238?
- Medium severity. CVSS v3 base score is 6.7 out of 10.