CVE-2025-10238
HIGHCVSS 8.4/10EPSS 0.12%
Last modified
CVE-2025-10238 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).. EPSS estimates a 0.12% chance of exploitation in the next 30 days.
Description
During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad) BIOS | < 1.12 |
| Lenovo | X1 Carbon 13th Gen (Type 21NX, 21NY) Laptops (ThinkPad) BIOS | < 1.15 |
| Lenovo | P16v Gen 3 (Type 21RS, 21RT) Laptop (ThinkPad) BIOS | < BIOS: 1.13 / ECFW: 1.09 |
| Lenovo | L16 Gen 1 (Type 21L7 21L8) Laptops (ThinkPad) BIOS | < 1.40 |
| Lenovo | T14s Gen 6 (Type 21TB, 21TC) Laptops (ThinkPad) BIOS | < 1.11 |
| Lenovo | P14s Gen 6 (Type 21QT, 21QU) Laptops (ThinkPad) BIOS | < UEFI BIOS V1.22/ECP V1.13 |
| Lenovo | L13 Gen 6 (Type 21RB, 21RC) Laptops (ThinkPad) BIOS | < 1.15 |
| Lenovo | L14 Gen 6 (Type 21SE, 21SF) Laptops (ThinkPad) BIOS | < 1.14 |
| Lenovo | E16 Gen 3 (Type 22AY, 22B0) Laptop (ThinkPad) BIOS | < 1.38 |
| Lenovo | L16 Gen 2 (Type 21SC, 21SD) Laptops (ThinkPad) BIOS | < 1.13 |
| Lenovo | X13 Gen 6 (Type 21RM, 21RN) Laptops (ThinkPad) BIOS | < 1.62/1.12 |
| Lenovo | T14s Gen 6 (Type 21R1, 21R2) Laptops (ThinkPad) BIOS | < 1.10 |
| Lenovo | X1 2-in-1 Gen 9 (Type 21KE, 21KF) Laptop (ThinkPad) BIOS | < 1.45 |
| Lenovo | X1 Fold 16 Gen 1 (Type 21ES, 21ET) Laptop (ThinkPad) BIOS | < 1.25 |
| Lenovo | Z16 Gen 2 (Type 21JX, 21JY) Laptop (ThinkPad) BIOS | < 1.37 |
| Lenovo | P16v Gen 1 (Type 21FE, 21FF) Laptop (ThinkPad) BIOS | < 1.65/1.13 |
| Lenovo | X13 Gen 4 (Type 21J3, 21J4) Laptop (ThinkPad) BIOS | < 1.37 |
| Lenovo | T14s Gen 4 (Type 21F8, 21F9) Laptop (ThinkPad) BIOS | < 1.28 |
| Lenovo | P14s Gen 4 (Type 21K5, 21K6) Laptop (ThinkPad) BIOS | < 1.47 |
| Lenovo | P1 Gen 6 (Type 21FV, 21FW) Laptop (ThinkPad) BIOS | < 1.38 |
| Lenovo | P16v Gen 1 (Type 21FC, 21FD) Laptop (ThinkPad) BIOS | < BIOS: 1.40 / ECFW: 1.09 |
| Lenovo | P16 Gen 2 (Type 21FA, 21FB) Laptop (ThinkPad) BIOS | < BIOS: 1.61 / ECFW: 1.57 |
| Lenovo | X13 Yoga Gen 4 (Type 21F2, 21F3) Laptop (ThinkPad) BIOS | < 1.22 |
| Lenovo | P16s Gen 2 (Type 21HK, 21HL) Laptop (ThinkPad) BIOS | < 1.51 |
| Lenovo | E14 Gen 5 (Type 21JR, 21JS) Laptop (ThinkPad) BIOS | < 1.29 |
| Lenovo | T14s Gen 4 (Type 21F6, 21F7) Laptop (ThinkPad) BIOS | < 1.23 |
| Lenovo | ThinkPad R14 Gen 5 Type 21JM PRC BIOS | < 1.41 |
| Lenovo | L14 Gen 4 (Type 21H1, 21H2) Laptop (ThinkPad) BIOS | < 1.34 |
| Lenovo | L13 Gen 4 (Type 21FG, 21FH) Laptop (ThinkPad) BIOS | < 1.24 |
| Lenovo | X1 Nano Gen 3 (Type 21K1, 21K2) Laptop (ThinkPad) BIOS | < 1.28 |
| Lenovo | S2 Yoga Gen 8 (Types 21FU) China Only Laptop (ThinkPad) BIOS | < 1.28 |
| Lenovo | L15 Gen 4 (Type 21H7, 21H8) Laptops (ThinkPad) BIOS | < 1.27 |
| Lenovo | X1 Yoga 8th Gen (Type 21HQ, 21HR) Laptop (ThinkPad) BIOS | < 1.37 |
| Lenovo | T14s Gen 6 (Type 21M1, 21M2) Laptops (ThinkPad) BIOS | < 1.62/1.12 |
| Lenovo | P15v Gen 3 (Type 21EN 21EM) Laptop (ThinkPad) BIOS | <= 1.28 |
| Lenovo | P16 Gen 1 (Type 21D6, 21D7) Laptop (ThinkPad) BIOS | < 1.69 |
| Lenovo | X1 2-in-1 Gen 10 (Type 21NU, 21NV) Laptop (ThinkPad) BIOS | < 1.39 |
| Lenovo | X9-15 Gen 1 (Type 21Q6, 21Q7) Laptop (ThinkPad) BIOS | < 1.17 |
| Lenovo | X9-14 Gen 1 (Type 21QA, 21QB) Laptop (ThinkPad) BIOS | < 1.21 |
| Lenovo | T14s Gen 5 (Type 21LS, 21LT) Laptop (ThinkPad) BIOS | < 1.14 |
| Lenovo | L14 Gen 5 (Type 21L1, 21L2) Laptops (ThinkPad) BIOS | < 1.24 |
| Lenovo | E14 Gen 6 (Type 21M3, 21M4) Laptops (ThinkPad) BIOS | < 1.27 |
| Lenovo | E16 Gen 3 (Type 21SR, 21SS) Laptops (ThinkPad) BIOS | < 1.11 |
| Lenovo | T14 Gen 3 (Type 21AH, 21AJ) Laptop (ThinkPad) BIOS | < 1.45/1.25 |
| Lenovo | T15p Gen 3 (Type 21DA 21DB) Laptop (ThinkPad) BIOS | < 1.67 |
| Lenovo | P1 Gen 5 (Type 21DC 21DD) Laptop (ThinkPad) BIOS | < 1.29 |
| Lenovo | T14s Gen 3 (Type 21CQ 21CR) Laptop (ThinkPad) BIOS | < 1.51 |
| Lenovo | P14s Gen 3 (Type 21J5, 21J6) Laptop (ThinkPad) BIOS | < 1.63 |
| Lenovo | Z16 Gen 1 (Type 21D4, 21D5) Laptop (ThinkPad) BIOS | < 1.76 |
| Lenovo | T14s Gen 3 (Type 21BR 21BS) Laptop (ThinkPad) BIOS | < 1.48 |
Showing 50 of 108 affected configurations. See the CNA advisory for the full list.
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2025-10238?
During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).
How severe is CVE-2025-10238?
CVE-2025-10238 has a CVSS score of 8.4/10 (HIGH severity). The EPSS model estimates a 0.12% probability of exploitation in the next 30 days.
How do I fix CVE-2025-10238?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-10232A weakness has been identified in 299ko up to 2.0.0. Affecte…5.4
- CVE-2025-10233A security vulnerability has been detected in kalcaddle kodb…4.3
- CVE-2025-10234A vulnerability was detected in Scada-LTS up to 2.7.8.1. Thi…4.8
- CVE-2025-10235A flaw has been found in Scada-LTS up to 2.7.8.1. This issue…4.8
- CVE-2025-10236A vulnerability has been found in binary-husky gpt_academic …7.5
- CVE-2025-10237During an internal security assessment, a potential vulnerab…8.4
- CVE-2025-10239In Flowmon versions prior to 12.5.5, a vulnerability has bee…7.2
- CVE-2025-1024A vulnerability exists in ChurchCRM 5.13.0 that allows an at…4.8
- CVE-2025-10240A vulnerability exists in the Progress Flowmon web applicati…8.8
- CVE-2025-10242OS command injection in the admin panel of Ivanti EPMM befor…7.2
- CVE-2025-10243OS command injection in the admin panel of Ivanti EPMM befor…7.2
- CVE-2025-10244A maliciously crafted HTML payload, when rendered by the Aut…8.7
Are you affected by CVE-2025-10238?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST