EUVD-2025-210108
GHSA-p7jf-pwjp-h977
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconGain local admin on ThinkPad
-
DeliveryIdentify vulnerable BIOS SMI handler
-
ExploitTrigger SMI with crafted input
-
InstallOut-of-bounds write inside SMM
-
C2Execute arbitrary code in SMM
-
ExecuteInstall firmware-resident implant in SPI flash
-
ImpactPersistent compromise surviving OS reinstall
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution at high privilege (PR:H - Windows administrator or equivalent root-level access) on a ThinkPad running one of the listed vulnerable BIOS firmware images, with no user interaction (UI:N) and no remote network access (AV:L). The attacker must be able to invoke the specific affected SMI handler from the operating system, which on Windows generally means a kernel driver or privileged user-mode call into firmware interfaces. Limiting factors that reduce real-world risk: the attacker must already own the box at admin level, the bug is platform-specific to the enumerated ThinkPad model/BIOS combinations, and Secure Boot plus a BIOS administrator password do not block exploitation but do raise the cost of weaponizing the resulting SMM access for persistent firmware implants. |
| Impact | The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H yields 8.4 - high impact but gated on already having high local privileges (administrator/root). There is no EPSS score, KEV listing, or public POC referenced, so realistic mass-exploitation likelihood is low; the practical threat model is post-compromise persistence (bootkit/firmware implant) by an attacker who already owns the OS, or an evil-maid scenario against a physically accessed device. The severity is therefore disproportionate to its volume risk: it will not be opportunistically scanned and exploited, but in targeted intrusions, supply-chain, or APT scenarios it is highly valuable because SMM code survives OS reinstall and evades EDR. Note that the description states 'privileged local user' but the CVSS vector confirms PR:H, so the two signals are consistent. |
| Exploit ScenarioDerived | An attacker who has already gained local administrator/SYSTEM on a vulnerable ThinkPad (for example via a phishing payload or post-exploitation tool) invokes the vulnerable SMI handler with crafted parameters to trigger the out-of-bounds write inside SMM. The resulting SMM code execution is used to plant a firmware-resident implant in SPI flash, disable Secure Boot enforcement, or extract secrets from protected memory regions, giving persistence that survives OS reinstall and is invisible to EDR. No public POC is referenced in the supplied data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 10, 2026
Local privilege escalation to System Management Mode (SMM) in Lenovo ThinkPad BIOS firmware allows a high-privileged local user to execute arbitrary code at one of the most privileged execution rings on x86 hardware. The flaw, an out-of-bounds write (CWE-787) discovered by Lenovo during an internal security assessment, affects a wide range of current-generation ThinkPad models including X1 Carbon 13th Gen, X13 Gen 6, T14s Gen 6, P14s/P16v Gen 3, L13/L14/L16 Gen 6, and E16 Gen 3. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: install the BIOS/UEFI firmware update published by Lenovo for the affected model from https://support.lenovo.com/us/en/product_security/LEN-218282, using Lenovo System Update, Lenovo Vantage, or the model-specific BIOS package; the exact fixed firmware revision is per-model and should be read from that advisory. As compensating controls until firmware is deployed, restrict and audit local administrator accounts (since PR:H is required), enable BIOS administrator password and Secure Boot to raise the bar on firmware modification, enforce measured boot/DRTM where supported and monitor TPM PCR values for SMM-related changes, and use endpoint controls to reduce the chance of an attacker reaching local administrator on the host. Note that firmware updates can require AC power, may reset BIOS settings, and on some platforms BitLocker may prompt for recovery - plan accordingly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 98 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the UEFI/BIOS firmware shipped on the listed ThinkPad platforms. SMM is the highest-privilege x86 execution mode (sometimes called 'ring -2'), running below the OS and hypervisor with full access to physical memory, SPI flash, and platform hardware. An out-of-bounds write (CWE-787) inside an SMI handler typically means an attacker-controlled pointer or length lets code reach SMRAM or adjacent SMM data, corrupting structures used after the SMI entry. Successful exploitation effectively bypasses Secure Boot, BitLocker key protection assumptions, and hypervisor isolation because SMM code executes outside the OS trust boundary.
Know when X13 Gen 6 Type 21Rk 21Rl Laptops Thinkpad Bios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (lenovo) · only source for this CVE.
CVSS VectorVendor: lenovo
Lifecycle Timeline
4DescriptionCVE.org
During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).
Executive ViewAI
Lenovo ThinkPad BIOS firmware across multiple current-generation models contains a privilege escalation vulnerability (CVE-2025-10238) that allows local users with elevated privileges to execute arbitrary code at the System Management Mode level, enabling complete device compromise and potential network persistence. The vulnerability affects widely-deployed business devices including X1 Carbon Gen 13, X13 Gen 6, T14s Gen 6, P14s/P16v Gen 3, and L-series ThinkPads, with no currently available vendor patch. Without mitigation, compromised devices could serve as persistent entry points for attacks while remaining undetectable to standard security tools.
No vendor-released patch identified at time of analysis. Interim mitigations: implement strict role-based access controls limiting local administrative privileges on affected devices; enforce physical device security measures; monitor system logs for privilege escalation and SMM-related activity; consider deploying firmware integrity verification tools; establish priority vendor notification channels to receive patch advisories immediately upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB