CVE-2025-10238

SMM code execution via out-of-bounds write

Published Jun 10, 2026 · Updated Jun 10, 2026

Out-of-bounds write in Lenovo ThinkPad BIOS allows privileged local users to execute code in System Management Mode. Lenovo has not published the affected firmware handler, the attacker-controlled input, or the operation that writes beyond its destination buffer. Exploitation requires high local privileges and grants code execution beneath the operating system with SMM authority.

CVSS severity8.4

High

EPSS probability0.12%

Next 30 days · Sep 16, 2026

Known exploitationUnconfirmed

Based on sourced intelligence

Hinoki checkNot available

Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

The record

CVE: CVE-2025-10238
Published: Jun 10, 2026
Updated: Jun 10, 2026

Vendor: Lenovo
Product: ThinkPad X13 Gen 6 (Type 21RM, 21RN) BIOS
Classifications: CWE-787, T1068

Attack vector: local
Privileges: admin

Timeline

How it unfolded

Jun 10, 2026CVE publishedPublication date reported by the CVE source.
Jun 10, 2026Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

Affected versionversion=0 <1.62/1.12

What conditions does exploitation require?

Attack vectorlocal

Required privilegesadmin

What is affected?

Lenovo · ThinkPad X13 Gen 6 (Type 21RM, 21RN) BIOSversion=0 <1.62/1.12

Lenovo · T14s Gen 6 (Type 21TB, 21TC) Laptops (ThinkPad) BIOSversion=0 <1.11

Lenovo · ThinkPad L13 Gen 4 (Type 21FG, 21FH) BIOSversion=0 <1.24

Lenovo · L14 Gen 3 (type 21C1, 21C2) Laptops (ThinkPad) BIOSversion=0 <1.44

Lenovo · ThinkPad T14 Gen 5 (Type 21MC, 21MD) BIOSversion=0 <1.18

Lenovo · ThinkPad L14 Gen 2 (Type 20X1, 20X2) BIOSversion=0 <1.73

Lenovo · P1 Gen 5 (Type 21DC 21DD) Laptop (ThinkPad) BIOSversion=0 <1.29

Lenovo · Z16 Gen 1 (Type 21D4, 21D5) Laptop (ThinkPad) BIOSversion=0 <1.76

Lenovo · ThinkPad P1 Gen 7 (Type 21KV, 21KW) BIOSversion=0 <1.17

Lenovo · ThinkPad P16 Gen 2 (Type 21FA, 21FB) BIOSversion=0 <BIOS: 1.61 / ECFW: 1.57

Lenovo · ThinkPad X1 Extreme 2nd Gen (Type 20QV, 20QW) BIOSversion=0 <1.55

Lenovo · ThinkPad P16 Gen 1 (Type 21D6, 21D7) BIOSversion=0 <1.69

Lenovo · P1 Gen 6 (Type 21FV, 21FW) Laptop (ThinkPad) BIOSversion=0 <1.38

Lenovo · ThinkPad T15p Gen 3 (Type 21DA, 21DB) BIOSversion=0 <1.67

Lenovo · ThinkPad T16 Gen 4 (Type 21QE, 21QF) BIOSversion=0 <1.10

Lenovo · ThinkPad E14 Gen 6 (Type 21M3, 21M4) BIOSversion=0 <1.27

Lenovo · ThinkPad P16v Gen 1 (Type 21FE, 21FF) BIOSversion=0 <1.65/1.13

Lenovo · ThinkPad S2 Yoga Gen 8 (Type 21FU) China Only BIOSversion=0 <1.28

Lenovo · ThinkPad T14 Gen 3 (Type 21AH, 21AJ) BIOSversion=0 <1.45/1.25

Lenovo · ThinkPad T14s Gen 5 (Type 21LS, 21LT) BIOSversion=0 <1.14

Lenovo · ThinkPad P16v Gen 3 (Type 21RS, 21RT) BIOSversion=0 <BIOS: 1.13 / ECFW: 1.09

Lenovo · ThinkPad P15v Gen 3 (Type 21EM, 21EN) BIOSversion=0 <=1.28

Lenovo · X13 Gen 5 (Type 21LU, 21LV) Laptop (ThinkPad) BIOSversion=0 <1.17

Lenovo · ThinkPad X1 2 in 1 Gen 9 (Type 21KE, 21KF) BIOSversion=0 <1.45

Lenovo · ThinkPad T15p Gen 2 (Type 21A7, 21A8) BIOSversion=0 <1.83

Lenovo · ThinkPad P17 Gen 2 (Type 20YU, 20YV) BIOSversion=0 <1.97

Lenovo · ThinkPad P16v Gen 2 (Type 21KX, 21KY) BIOSversion=0 <1.18

Lenovo · ThinkPad S2 Yoga Gen 6 Type 21AG China Only BIOSversion=0 <=1.38

Lenovo · X1 Nano Gen 1 (Type 20UN 20UQ) Laptop (ThinkPad) BIOSversion=0 <1.68

Lenovo · ThinkPad X1 Yoga 5th Gen (Type 20UB, 20UC) BIOSversion=0 <1.41

Lenovo · E14 Gen 5 (Type 21JR, 21JS) Laptop (ThinkPad) BIOSversion=0 <1.29

Lenovo · X1 Extreme 4th Gen (Type 20Y5, 20Y6) Laptop (ThinkPad) BIOSversion=0 <1.33

Lenovo · ThinkPad X13 Gen 2 (Type 20WK, 20WL) BIOSversion=0 <1.64

Lenovo · ThinkPad T14s Gen 4 (Type 21F8, 21F9) BIOSversion=0 <1.28

Lenovo · ThinkPad L14 Gen 5 (Type 21L1, 21L2) BIOSversion=0 <1.24

Lenovo · X390 Yoga (Type 20NN, 20NQ) Laptop (ThinkPad) BIOSversion=0 <2.05

Lenovo · ThinkPad T14s Gen 3 (Type 21CQ, 21CR) BIOSversion=0 <1.51

Lenovo · ThinkPad X1 Fold 16 Gen 1 (Type 21ES, 21ET) BIOSversion=0 <1.25

Lenovo · ThinkPad X1 Yoga 7th Gen (Type 21CD, 21CE) BIOSversion=0 <1.52

Lenovo · E15 Gen 4 (type 21ED 21EE) Laptop (ThinkPad) BIOSversion=0 <1.27

Lenovo · T14s Gen 6 (Type 21M1, 21M2) Laptops (ThinkPad) BIOSversion=0 <1.62/1.12

Lenovo · ThinkPad E14 Gen 7 (Type 21T9, 21TA) BIOSversion=0 <1.11

Lenovo · ThinkPad T14s Gen 3 (Type 21BR, 21BS) BIOSversion=0 <1.48

Lenovo · ThinkPad L15 Gen 4 (Type 21H7, 21H8) BIOSversion=0 <1.27

Lenovo · ThinkPad X1 Yoga 6th Gen (Type 20XY, 20Y0) BIOSversion=0 <1.75

Lenovo · L14 Gen 2 (type 20X5, 20X6) Laptop (ThinkPad) BIOSversion=0 <1.36

Lenovo · ThinkPad Z16 Gen 2 (Type 21JX, 21JY) BIOSversion=0 <1.37

Lenovo · ThinkPad X13 Gen 2 (Type 20XH, 20XJ) BIOSversion=0 <1.36

Lenovo · L13 (type 20R3, 20R4) Laptops (ThinkPad) BIOSversion=0 <1.45

Lenovo · ThinkPad X1 Extreme 3rd Gen (Type 20TK, 20TL) BIOSversion=0 <1.37

Lenovo · ThinkPad P16s Gen 2 (Type 21HK, 21HL) BIOSversion=0 <1.51

Lenovo · T16 Gen 4 (Type 22AW, 22AX) Laptops (ThinkPad) BIOSversion=0 <1.08

Lenovo · ThinkPad P16v Gen 1 (Type 21FC, 21FD) BIOSversion=0 <BIOS: 1.40 / ECFW: 1.09

Lenovo · ThinkPad T15 (Type 20S6, 20S7) BIOSversion=0 <1.34

Lenovo · ThinkPad X1 Nano Gen 3 (Type 21K1, 21K2) BIOSversion=0 <1.28

Lenovo · ThinkPad L390 (Type 20NR, 20NS) BIOSversion=0 <1.53

Lenovo · ThinkPad R14 Gen 5 Type 21JM PRC BIOSversion=0 <1.41

Lenovo · ThinkPad P14s Gen 6 (Type 21QL, 21QM) BIOSversion=0 <1.17

Lenovo · ThinkPad X1 Nano Gen 2 (Type 21E8, 21E9) BIOSversion=0 <1.32

Lenovo · ThinkPad T16 Gen 3 (Type 21MN, 21MQ) BIOSversion=0 <1.16

Lenovo · ThinkPad X13 Yoga Gen 1 (Type 20SX, 20SY) BIOSversion=0 <1.57

Lenovo · ThinkPad E16 Gen 3 (Type 21SR, 21SS) BIOSversion=0 <1.11

Lenovo · ThinkPad X1 Yoga 8th Gen (Type 21HQ, 21HR) BIOSversion=0 <1.37

Lenovo · L13 Yoga Gen 3 (Type 21B5, 21B6) Laptop (ThinkPad) BIOSversion=0 <1.31

Lenovo · ThinkPad P14s Gen 2 (Type 21A0, 21A1) BIOSversion=0 <1.33

Lenovo · X1 Fold Gen 1 (Type 20RK, 20RL) Laptop (ThinkPad) BIOSversion=0 <1.34

Lenovo · ThinkPad E16 Gen 2 (Type 21MA, 21MB) BIOSversion=0 <1.21

Lenovo · ThinkPad E16 Gen 3 (Type 21ST, 21SU) BIOSversion=0 <1.21

Lenovo · T15 Gen 2 (Type 20W4, 20W5) Laptop (ThinkPad) BIOSversion=0 <1.69/1.21

Lenovo · ThinkPad T15g Gen 1 (Type 20UR, 20US) BIOSversion=0 <1.97

Lenovo · ThinkPad T14s Gen 6 (Type 21R1, 21R2) BIOSversion=0 <1.10

Lenovo · ThinkPad X12 Detachable Gen 1 (Type 20UW, 20UV) BIOSversion=0 <=1.40

Lenovo · ThinkPad X9-14 Gen 1 (Type 21QA, 21QB) BIOSversion=0 <1.21

Lenovo · ThinkPad X1 Carbon 13th Gen (Type 21NX, 21NY) BIOSversion=0 <1.15

Lenovo · ThinkPad T490 (Type 20N2, 20N3) BIOSversion=0 <1.85/1.26

Lenovo · L13 Gen 5 (Type 21LB, 21LC) Laptops (ThinkPad) BIOSversion=0 <1.21

Lenovo · ThinkPad S2 Yoga Gen 6 (Type 20VN, China Only) BIOSversion=0 <1.38/1.36

Lenovo · ThinkPad X9-15 Gen 1 (Type 21Q6, 21Q7) BIOSversion=0 <1.17

Lenovo · ThinkPad T14s Gen 4 (Type 21F6, 21F7) BIOSversion=0 <1.23

Lenovo · P14s Gen 3 (Type 21J5, 21J6) Laptop (ThinkPad) BIOSversion=0 <1.63

Lenovo · ThinkPad P14s Gen 5 (Type 21G2, 21G3) BIOSversion=0 <1.26

Lenovo · ThinkPad X1 2-in-1 Gen 10 (Type 21NU, 21NV) BIOSversion=0 <1.39

Lenovo · ThinkPad L14 Gen 4 (Type 21H1, 21H2) BIOSversion=0 <1.34

Lenovo · ThinkPad L14 Gen 3 (Type 21C5, 21C6) BIOSversion=0 <1.36

Lenovo · ThinkPad X13 Gen 6 (Type 21RK, 21RL) BIOSversion=0 <1.12

Lenovo · ThinkPad E15 Gen 3 (Type 20YG, 20YH, 20YJ, 20YK) BIOSversion=0 <1.24

Lenovo · ThinkPad P14s Gen 4 (Type 21K5, 21K6) BIOSversion=0 <1.47

Lenovo · ThinkPad X390 (Type 20SC, 20SD) BIOSversion=0 <1.87/1.32

Lenovo · ThinkPad X12 Detachable Gen 2 (Type 21LK, 21LL) BIOSversion=0 <1.21

Lenovo · ThinkPad L13 2-in-1 Gen 6 (Type 21R7, 21R8) BIOSversion=0 <1.10

Lenovo · ThinkPad L13 Gen 6 (Type 21RB, 21RC) BIOSversion=0 <1.15

Lenovo · ThinkPad E14 Gen 4 (Type 21E3, 21E4) BIOSversion=0 <1.34

Lenovo · ThinkPad P14s Gen 6 (Type 21QT, 21QU) BIOSversion=0 <UEFI BIOS V1.22/ECP V1.13

Lenovo · ThinkPad X13 Yoga Gen 4 (Type 21F2, 21F3) BIOSversion=0 <1.22

Lenovo · ThinkPad L16 Gen 1 (Type 21L7, 21L8) BIOSversion=0 <1.40

Lenovo · ThinkPad L14 Gen 6 (Type 21S6, 21S7) BIOSversion=0 <1.06

Lenovo · ThinkPad X13 Yoga Gen 3 (Type 21AW, 21AX) BIOSversion=0 <1.25

Lenovo · ThinkPad X1 Titanium (Type 20QA, 20QB) BIOSversion=0 <1.37

Lenovo · ThinkPad L16 Gen 2 (Type 21SC, 21SD) BIOSversion=0 <1.13

Lenovo · ThinkPad T14s (Type 20T0, 20T1) BIOSversion=0 <1.37

Lenovo · ThinkPad X13 Yoga Gen 2 (Type 20W8, 20W9) BIOSversion=0 <1.51

Lenovo · ThinkPad X1 Yoga 4th Gen (Type 20SA, 20SB) BIOSversion=0 <1.66/1.55

Lenovo · ThinkPad X13 Gen 4 (Type 21J3, 21J4) BIOSversion=0 <1.37

Lenovo · ThinkPad S2 Gen 7 (Type 21BD) BIOSversion=0 <=1.36

Lenovo · ThinkPad E16 Gen 3 (Type 22AY, 22B0) BIOSversion=0 <1.38

Lenovo · ThinkPad T14s Gen 6 (Type 21QX, 21QY) BIOSversion=0 <1.14

Lenovo · ThinkPad L14 Gen 6 (Type 21SE, 21SF) BIOSversion=0 <1.14

Lenovo · ThinkPad P73 (Type 20QR, 20QS) BIOSversion=0 <2.01

Published CVSS scores

8.4Lenovo Group Ltd.CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

6.7Lenovo Group Ltd.CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 10, 2026Sep 16, 2026

Latest reporting daySep 16, 2026

Latest daily unique IPsUnavailable

Prior 30-day averageUnavailable

SourceShadowserver honeypots (KEV)

Vectorlocal

Privilegesadmin

Known exploitationUnconfirmed

Public exploitUnconfirmed

Weakness, pattern, technique

CWE-787Out-of-bounds Write

T1068Exploitation for Privilege Escalation

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo