Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2025-10238

Out-of-bounds write in Lenovo X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad) BIOS and others

CVSS 8.4 HighEPSS 0.0012 · 1st percentile

Published by the CVE Program (CNA: lenovo) at 10 Jun 2026, 14:11 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Lenovo X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad) BIOS
  • affected before 1.12 custom
Other versions: unaffected
Lenovo X1 Carbon 13th Gen (Type 21NX, 21NY) Laptops (ThinkPad) BIOS
  • affected before 1.15 custom
Other versions: unaffected
Lenovo P16v Gen 3 (Type 21RS, 21RT) Laptop (ThinkPad) BIOS
  • affected before BIOS: 1.13 / ECFW: 1.09 custom
Other versions: unaffected
Lenovo L16 Gen 1 (Type 21L7 21L8) Laptops (ThinkPad) BIOS
  • affected before 1.40 custom
Other versions: unaffected
Lenovo T14s Gen 6 (Type 21TB, 21TC) Laptops (ThinkPad) BIOS
  • affected before 1.11 custom
Other versions: unaffected
Lenovo P14s Gen 6 (Type 21QT, 21QU) Laptops (ThinkPad) BIOS
  • affected before UEFI BIOS V1.22/ECP V1.13 custom
Other versions: unaffected
Lenovo L13 Gen 6 (Type 21RB, 21RC) Laptops (ThinkPad) BIOS
  • affected before 1.15 custom
Other versions: unaffected
Lenovo L14 Gen 6 (Type 21SE, 21SF) Laptops (ThinkPad) BIOS
  • affected before 1.14 custom
Other versions: unaffected
Lenovo E16 Gen 3 (Type 22AY, 22B0) Laptop (ThinkPad) BIOS
  • affected before 1.38 custom
Other versions: unaffected
Lenovo L16 Gen 2 (Type 21SC, 21SD) Laptops (ThinkPad) BIOS
  • affected before 1.13 custom
Other versions: unaffected
Lenovo X13 Gen 6 (Type 21RM, 21RN) Laptops (ThinkPad) BIOS
  • affected before 1.62/1.12 custom
Other versions: unaffected
Lenovo T14s Gen 6 (Type 21R1, 21R2) Laptops (ThinkPad) BIOS
  • affected before 1.10 custom
Other versions: unaffected
Lenovo X1 2-in-1 Gen 9 (Type 21KE, 21KF) Laptop (ThinkPad) BIOS
  • affected before 1.45 custom
Other versions: unaffected
Lenovo X1 Fold 16 Gen 1 (Type 21ES, 21ET) Laptop (ThinkPad) BIOS
  • affected before 1.25 custom
Other versions: unaffected
Lenovo Z16 Gen 2 (Type 21JX, 21JY) Laptop (ThinkPad) BIOS
  • affected before 1.37 custom
Other versions: unaffected
Lenovo P16v Gen 1 (Type 21FE, 21FF) Laptop (ThinkPad) BIOS
  • affected before 1.65/1.13 custom
Other versions: unaffected
Lenovo X13 Gen 4 (Type 21J3, 21J4) Laptop (ThinkPad) BIOS
  • affected before 1.37 custom
Other versions: unaffected
Lenovo T14s Gen 4 (Type 21F8, 21F9) Laptop (ThinkPad) BIOS
  • affected before 1.28 custom
Other versions: unaffected
Lenovo P14s Gen 4 (Type 21K5, 21K6) Laptop (ThinkPad) BIOS
  • affected before 1.47 custom
Other versions: unaffected
Lenovo P1 Gen 6 (Type 21FV, 21FW) Laptop (ThinkPad) BIOS
  • affected before 1.38 custom
Other versions: unaffected
Lenovo P16v Gen 1 (Type 21FC, 21FD) Laptop (ThinkPad) BIOS
  • affected before BIOS: 1.40 / ECFW: 1.09 custom
Other versions: unaffected
Lenovo P16 Gen 2 (Type 21FA, 21FB) Laptop (ThinkPad) BIOS
  • affected before BIOS: 1.61 / ECFW: 1.57 custom
Other versions: unaffected
Lenovo X13 Yoga Gen 4 (Type 21F2, 21F3) Laptop (ThinkPad) BIOS
  • affected before 1.22 custom
Other versions: unaffected
Lenovo P16s Gen 2 (Type 21HK, 21HL) Laptop (ThinkPad) BIOS
  • affected before 1.51 custom
Other versions: unaffected
Lenovo E14 Gen 5 (Type 21JR, 21JS) Laptop (ThinkPad) BIOS
  • affected before 1.29 custom
Other versions: unaffected
Lenovo T14s Gen 4 (Type 21F6, 21F7) Laptop (ThinkPad) BIOS
  • affected before 1.23 custom
Other versions: unaffected
Lenovo ThinkPad R14 Gen 5 Type 21JM PRC BIOS
  • affected before 1.41 custom
Other versions: unaffected
Lenovo L14 Gen 4 (Type 21H1, 21H2) Laptop (ThinkPad) BIOS
  • affected before 1.34 custom
Other versions: unaffected
Lenovo L13 Gen 4 (Type 21FG, 21FH) Laptop (ThinkPad) BIOS
  • affected before 1.24 custom
Other versions: unaffected
Lenovo X1 Nano Gen 3 (Type 21K1, 21K2) Laptop (ThinkPad) BIOS
  • affected before 1.28 custom
Other versions: unaffected
Lenovo S2 Yoga Gen 8 (Types 21FU) China Only Laptop (ThinkPad) BIOS
  • affected before 1.28 custom
Other versions: unaffected
Lenovo L15 Gen 4 (Type 21H7, 21H8) Laptops (ThinkPad) BIOS
  • affected before 1.27 custom
Other versions: unaffected
Lenovo X1 Yoga 8th Gen (Type 21HQ, 21HR) Laptop (ThinkPad) BIOS
  • affected before 1.37 custom
Other versions: unaffected
Lenovo T14s Gen 6 (Type 21M1, 21M2) Laptops (ThinkPad) BIOS
  • affected before 1.62/1.12 custom
Other versions: unaffected
Lenovo P15v Gen 3 (Type 21EN 21EM) Laptop (ThinkPad) BIOS
  • affected 1.28 and earlier custom
Other versions: unaffected
Lenovo P16 Gen 1 (Type 21D6, 21D7) Laptop (ThinkPad) BIOS
  • affected before 1.69 custom
Other versions: unaffected
Lenovo X1 2-in-1 Gen 10 (Type 21NU, 21NV) Laptop (ThinkPad) BIOS
  • affected before 1.39 custom
Other versions: unaffected
Lenovo X9-15 Gen 1 (Type 21Q6, 21Q7) Laptop (ThinkPad) BIOS
  • affected before 1.17 custom
Other versions: unaffected
Lenovo X9-14 Gen 1 (Type 21QA, 21QB) Laptop (ThinkPad) BIOS
  • affected before 1.21 custom
Other versions: unaffected
Lenovo T14s Gen 5 (Type 21LS, 21LT) Laptop (ThinkPad) BIOS
  • affected before 1.14 custom
Other versions: unaffected

And 68 more products. The full list is on the CVE record.

Identifiers
CVE-2025-10238
CNA
lenovo
Weakness (CWE)
CWE-787
Tags
Published
10 Jun 2026
Updated
11 Jun 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
8.4 High 4.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CNA (lenovo)Used for this record
6.7 Medium 3.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CNA (lenovo)
  • CISA KEV Not listed.
  • EPSS 0.0012, the 1st percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 10 Jun 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.