Common Weakness Enumeration
CWE-787
Allowed-with-ReviewOut-of-bounds Write
Abstraction: Base · Status: Draft
The product writes data past the end, or before the beginning, of the intended buffer.
15115 vulnerabilities reference this CWE, most recent first.
CVE-2025-10451 (GCVE-0-2025-10451)
Vulnerability from cvelistv5 – Published: 2025-12-12 00:28 – Updated: 2025-12-12 18:45
VLAI
EPSS
VEX
Title
H19Int15CallbackSmm: SMM memory corruption vulnerability in combined DXE/SMM (SMRAM write)
Summary
Unchecked output buffer may allowed arbitrary code execution in SMM and potentially result in SMM memory corruption.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Insyde Software | InsydeH2O |
Affected:
HP feature version before 20C1
|
Date Public
2025-12-09 00:23
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-12T18:44:42.715064Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-12T18:45:44.288Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "InsydeH2O",
"vendor": "Insyde Software",
"versions": [
{
"status": "affected",
"version": "HP feature version before 20C1"
}
]
}
],
"datePublic": "2025-12-09T00:23:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnchecked output buffer may allowed arbitrary code execution in SMM and potentially result in SMM memory corruption.\u003c/span\u003e"
}
],
"value": "Unchecked output buffer may allowed arbitrary code execution in SMM and potentially result in SMM memory corruption."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-12T00:30:25.404Z",
"orgId": "8338d8cb-57f7-4252-abc0-96fd13e98d21",
"shortName": "Insyde"
},
"references": [
{
"url": "https://www.insyde.com/security-pledge/sa-2025009/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "H19Int15CallbackSmm: SMM memory corruption vulnerability in combined DXE/SMM (SMRAM write)",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "8338d8cb-57f7-4252-abc0-96fd13e98d21",
"assignerShortName": "Insyde",
"cveId": "CVE-2025-10451",
"datePublished": "2025-12-12T00:28:52.829Z",
"dateReserved": "2025-09-15T01:13:10.842Z",
"dateUpdated": "2025-12-12T18:45:44.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-10238 (GCVE-0-2025-10238)
Vulnerability from cvelistv5 – Published: 2026-06-10 14:11 – Updated: 2026-06-11 03:55
VLAI
EPSS
VEX
Summary
During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
Impacted products
108 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10238",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T03:55:27.982Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.12",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Carbon 13th Gen (Type 21NX, 21NY) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.15",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P16v Gen 3 (Type 21RS, 21RT) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "BIOS: 1.13 / ECFW: 1.09",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L16 Gen 1 (Type 21L7 21L8) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T14s Gen 6 (Type 21TB, 21TC) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.11",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P14s Gen 6 (Type 21QT, 21QU) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "UEFI BIOS V1.22/ECP V1.13",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L13 Gen 6 (Type 21RB, 21RC) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.15",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L14 Gen 6 (Type 21SE, 21SF) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "E16 Gen 3 (Type 22AY, 22B0) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.38",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L16 Gen 2 (Type 21SC, 21SD) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.13",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X13 Gen 6 (Type 21RM, 21RN) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.62/1.12",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T14s Gen 6 (Type 21R1, 21R2) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 2-in-1 Gen 9 (Type 21KE, 21KF) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.45",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Fold 16 Gen 1 (Type 21ES, 21ET) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.25",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Z16 Gen 2 (Type 21JX, 21JY) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.37",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P16v Gen 1 (Type 21FE, 21FF) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.65/1.13",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X13 Gen 4 (Type 21J3, 21J4) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.37",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T14s Gen 4 (Type 21F8, 21F9) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.28",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P14s Gen 4 (Type 21K5, 21K6) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.47",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P1 Gen 6 (Type 21FV, 21FW) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.38",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P16v Gen 1 (Type 21FC, 21FD) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "BIOS: 1.40 / ECFW: 1.09",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P16 Gen 2 (Type 21FA, 21FB) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "BIOS: 1.61 / ECFW: 1.57",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X13 Yoga Gen 4 (Type 21F2, 21F3) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.22",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P16s Gen 2 (Type 21HK, 21HL) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.51",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "E14 Gen 5 (Type 21JR, 21JS) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T14s Gen 4 (Type 21F6, 21F7) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.23",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ThinkPad R14 Gen 5 Type 21JM PRC BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.41",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L14 Gen 4 (Type 21H1, 21H2) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.34",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L13 Gen 4 (Type 21FG, 21FH) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.24",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Nano Gen 3 (Type 21K1, 21K2) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.28",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "S2 Yoga Gen 8 (Types 21FU) China Only Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.28",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L15 Gen 4 (Type 21H7, 21H8) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Yoga 8th Gen (Type 21HQ, 21HR) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.37",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T14s Gen 6 (Type 21M1, 21M2) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.62/1.12",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P15v Gen 3 (Type 21EN 21EM) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThanOrEqual": "1.28",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P16 Gen 1 (Type 21D6, 21D7) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.69",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 2-in-1 Gen 10 (Type 21NU, 21NV) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.39",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X9-15 Gen 1 (Type 21Q6, 21Q7) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X9-14 Gen 1 (Type 21QA, 21QB) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.21",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T14s Gen 5 (Type 21LS, 21LT) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L14 Gen 5 (Type 21L1, 21L2) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.24",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "E14 Gen 6 (Type 21M3, 21M4) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "E16 Gen 3 (Type 21SR, 21SS) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.11",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T14 Gen 3 (Type 21AH, 21AJ) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.45/1.25",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T15p Gen 3 (Type 21DA 21DB) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.67",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P1 Gen 5 (Type 21DC 21DD) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T14s Gen 3 (Type 21CQ 21CR) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.51",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P14s Gen 3 (Type 21J5, 21J6) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.63",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Z16 Gen 1 (Type 21D4, 21D5) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T14s Gen 3 (Type 21BR 21BS) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L14 Gen 3 (type 21C1, 21C2) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.44",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X13 Yoga Gen 3 (Type 21AW 21AX) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.25",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L13 Yoga Gen 3 (Type 21B5, 21B6) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.31",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "E14 Gen 4 (type 21E3, 21E4) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.34",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Nano Gen 2 (Type 21E8 21E9) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "E15 Gen 4 (type 21ED 21EE) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ThinkPad S2 Gen 7 Type 21BD BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThanOrEqual": "1.36",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Yoga 7th Gen (Type 21CD, 21CE) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.52",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L14 Gen 3 (type 21C5, 21C6) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.36",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ThinkPad S2 Yoga Gen 6 Type 20VN China Only BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.38/1.36",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Yoga 6th Gen (Type 20XY, 20Y0) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.75",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "E15 Gen 3 (Type 20YG, 20YH, 20YJ, 20YK) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.24",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X13 Yoga Gen 2 (Type 20W8, 20W9) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.51",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X13 Gen 2 (Type 20WK, 20WL) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.64",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L14 Gen 2 (type 20X5, 20X6) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.36",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T15g Gen 1 (type 20UR 20US) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.97",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X13 Gen 2 (Type 20XH, 20XJ) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.36",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T15p Gen 2 (Type 21A7, 21A8) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.83",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P14s Gen 2 (type 21A0, 21A1) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.33",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ThinkPad S2 Yoga Gen 6 Type 21AG China Only BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThanOrEqual": "1.38",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Extreme 4th Gen (Type 20Y5, 20Y6) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.33",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P17 Gen 2 (type 20YU, 20YV) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.97",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Titanium (Type 20QA, 20QB) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.37",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Nano Gen 1 (Type 20UN 20UQ) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.68",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X12 Detachable Gen 1 (Type 20UW, 20UV) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThanOrEqual": "1.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "E16 Gen 2 (Type 21MA, 21MB) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.21",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X13 Gen 5 (Type 21LU, 21LV) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L14 Gen 2 Type 20X1 20X2 Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.73",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "E16 Gen 3 (Type 21ST, 21SU) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.21",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T16 Gen 4 (Type 21QE, 21QF) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T16 Gen 4 (Type 22AW, 22AX) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.08",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T15 Gen 2 (Type 20W4, 20W5) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.69/1.21",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Fold Gen 1 (Type 20RK, 20RL) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.34",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Extreme 3rd Gen (Type 20TK, 20TL) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.37",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T14s (Type 20T0, 20T1) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.37",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T15 (type 20S6, 20S7) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.34",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X13 Yoga Gen 1 (Type 20SX, 20SY) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.57",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Yoga 5th Gen (Type 20UB, 20UC) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.41",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X390 Yoga (Type 20NN, 20NQ) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "2.05",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Yoga 4th Gen (Type 20SA, 20SB) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.66/1.55",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X390 (Type 20SC, 20SD) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.87/1.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P73 (type 20QR, 20QS) Laptop (Thinkpad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "2.01",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T490 (Type 20N2, 20N3) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.85/1.26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X1 Extreme 2nd Gen (Type 20QV, 20QW) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.55",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L390 (type 20NR, 20NS) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.53",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L13 (type 20R3, 20R4) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.45",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L13 Gen 5 (Type 21LB, 21LC) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.21",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "E14 Gen 7 (Type 21T9, 21TA) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.11",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P14s Gen 6 (Type 21QL, 21QM) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L13 2-in-1 Gen 6 (Type 21R7, 21R8) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L14 Gen 6 (Type 21S6, 21S7) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T14s Gen 6 (Type 21QX, 21QY) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P1 Gen 7 (Type 21KV, 21KW) Laptop (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P14s Gen 5 (Type 21G2, 21G3) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T14 Gen 5 (Type 21MC, 21MD) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "X12 Detachable Gen 2 (Type 21LK, 21LL) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.21",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T16 Gen 3 (Type 21MN, 21MQ) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "P16v Gen 2 (Type 21KX, 21KY) Laptops (ThinkPad) BIOS",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x13_gen_6_type_21rk_21rl_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.12",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_carbon_13th_gen_type_21nx_21ny_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.15",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p16v_gen_3_type_21rs_21rt_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "bios_1.13_ecfw_1.09",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l16_gen_1_type_21l7_21l8_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.40",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t14s_gen_6_type_21tb_21tc_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.11",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p14s_gen_6_type_21qt_21qu_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "uefi_bios_v1.22_ecp_v1.13",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l13_gen_6_type_21rb_21rc_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.15",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l14_gen_6_type_21se_21sf_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.14",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:e16_gen_3_type_22ay_22b0_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.38",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l16_gen_2_type_21sc_21sd_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.13",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x13_gen_6_type_21rm_21rn_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.62_1.12",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t14s_gen_6_type_21r1_21r2_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.10",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_2-in-1_gen_9_type_21ke_21kf_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.45",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_fold_16_gen_1_type_21es_21et_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.25",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:z16_gen_2_type_21jx_21jy_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.37",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p16v_gen_1_type_21fe_21ff_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.65_1.13",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x13_gen_4_type_21j3_21j4_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.37",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t14s_gen_4_type_21f8_21f9_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.28",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p14s_gen_4_type_21k5_21k6_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.47",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p1_gen_6_type_21fv_21fw_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.38",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p16v_gen_1_type_21fc_21fd_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "bios_1.40_ecfw_1.09",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p16_gen_2_type_21fa_21fb_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "bios_1.61_ecfw_1.57",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x13_yoga_gen_4_type_21f2_21f3_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.22",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p16s_gen_2_type_21hk_21hl_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.51",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:e14_gen_5_type_21jr_21js_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.29",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t14s_gen_4_type_21f6_21f7_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.23",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:thinkpad_r14_gen_5_type_21jm_prc_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.41",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l14_gen_4_type_21h1_21h2_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.34",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l13_gen_4_type_21fg_21fh_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.24",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_nano_gen_3_type_21k1_21k2_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.28",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:s2_yoga_gen_8_types_21fu_china_only_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.28",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l15_gen_4_type_21h7_21h8_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.27",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_yoga_8th_gen_type_21hq_21hr_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.37",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t14s_gen_6_type_21m1_21m2_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.62_1.12",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p15v_gen_3_type_21en_21em_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.28",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p16_gen_1_type_21d6_21d7_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.69",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_2-in-1_gen_10_type_21nu_21nv_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.39",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x9-15_gen_1_type_21q6_21q7_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.17",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x9-14_gen_1_type_21qa_21qb_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.21",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t14s_gen_5_type_21ls_21lt_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.14",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l14_gen_5_type_21l1_21l2_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.24",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:e14_gen_6_type_21m3_21m4_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.27",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:e16_gen_3_type_21sr_21ss_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.11",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t14_gen_3_type_21ah_21aj_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.45_1.25",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t15p_gen_3_type_21da_21db_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.67",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p1_gen_5_type_21dc_21dd_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.29",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t14s_gen_3_type_21cq_21cr_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.51",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p14s_gen_3_type_21j5_21j6_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.63",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:z16_gen_1_type_21d4_21d5_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.76",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t14s_gen_3_type_21br_21bs_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.48",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l14_gen_3_type_21c1_21c2_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.44",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x13_yoga_gen_3_type_21aw_21ax_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.25",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l13_yoga_gen_3_type_21b5_21b6_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.31",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:e14_gen_4_type_21e3_21e4_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.34",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_nano_gen_2_type_21e8_21e9_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.32",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:e15_gen_4_type_21ed_21ee_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.27",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:thinkpad_s2_gen_7_type_21bd_bios:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.36",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_yoga_7th_gen_type_21cd_21ce_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.52",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l14_gen_3_type_21c5_21c6_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.36",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:thinkpad_s2_yoga_gen_6_type_20vn_china_only_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.38_1.36",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_yoga_6th_gen_type_20xy_20y0_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.75",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:e15_gen_3_type_20yg_20yh_20yj_20yk_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.24",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x13_yoga_gen_2_type_20w8_20w9_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.51",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x13_gen_2_type_20wk_20wl_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.64",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l14_gen_2_type_20x5_20x6_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.36",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t15g_gen_1_type_20ur_20us_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.97",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x13_gen_2_type_20xh_20xj_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.36",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t15p_gen_2_type_21a7_21a8_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.83",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p14s_gen_2_type_21a0_21a1_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.33",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:thinkpad_s2_yoga_gen_6_type_21ag_china_only_bios:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.38",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_extreme_4th_gen_type_20y5_20y6_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.33",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p17_gen_2_type_20yu_20yv_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.97",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_titanium_type_20qa_20qb_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.37",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_nano_gen_1_type_20un_20uq_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.68",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x12_detachable_gen_1_type_20uw_20uv_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.40",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:e16_gen_2_type_21ma_21mb_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.21",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x13_gen_5_type_21lu_21lv_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.17",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l14_gen_2_type_20x1_20x2_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.73",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:e16_gen_3_type_21st_21su_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.21",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t16_gen_4_type_21qe_21qf_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.10",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t16_gen_4_type_22aw_22ax_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.08",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t15_gen_2_type_20w4_20w5_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.69_1.21",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_fold_gen_1_type_20rk_20rl_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.34",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_extreme_3rd_gen_type_20tk_20tl_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.37",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t14s_type_20t0_20t1_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.37",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t15_type_20s6_20s7_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.34",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x13_yoga_gen_1_type_20sx_20sy_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.57",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_yoga_5th_gen_type_20ub_20uc_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.41",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x390_yoga_type_20nn_20nq_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.05",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_yoga_4th_gen_type_20sa_20sb_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.66_1.55",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x390_type_20sc_20sd_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.87_1.32",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p73_type_20qr_20qs_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.01",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t490_type_20n2_20n3_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.85_1.26",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x1_extreme_2nd_gen_type_20qv_20qw_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.55",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l390_type_20nr_20ns_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.53",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l13_type_20r3_20r4_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.45",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l13_gen_5_type_21lb_21lc_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.21",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:e14_gen_7_type_21t9_21ta_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.11",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p14s_gen_6_type_21ql_21qm_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.17",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l13_2-in-1_gen_6_type_21r7_21r8_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.10",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:l14_gen_6_type_21s6_21s7_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.06",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t14s_gen_6_type_21qx_21qy_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.14",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p1_gen_7_type_21kv_21kw_laptop_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.17",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p14s_gen_5_type_21g2_21g3_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.26",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t14_gen_5_type_21mc_21md_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.18",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:x12_detachable_gen_2_type_21lk_21ll_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.21",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:t16_gen_3_type_21mn_21mq_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.16",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:p16v_gen_2_type_21kx_21ky_laptops_thinkpad_bios:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.18",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "During an internal security assessment, a\u0026nbsp;potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).\u0026nbsp;"
}
],
"value": "During an internal security assessment, a\u00a0potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM)."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T14:11:21.336Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-218282"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the version (or newer) as recommended in the advisory:\u0026nbsp;https://support.lenovo.com/us/en/product_security/LEN-218282"
}
],
"value": "Update to the version (or newer) as recommended in the advisory:\u00a0https://support.lenovo.com/us/en/product_security/LEN-218282"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2025-10238",
"datePublished": "2026-06-10T14:11:21.336Z",
"dateReserved": "2025-09-10T15:30:05.055Z",
"dateUpdated": "2026-06-11T03:55:27.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9903 (GCVE-0-2025-9903)
Vulnerability from cvelistv5 – Published: 2025-09-29 00:44 – Updated: 2026-03-15 23:37
VLAI
EPSS
VEX
Summary
Out-of-bounds write vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / Generic FAX Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://psirt.canon/advisory-information/cp2025-005/ | vendor-advisory |
| https://canon.jp/support/support-info/250925vulne… | vendor-advisory |
| https://www.usa.canon.com/about-us/to-our-custome… | vendor-advisory |
| https://www.canon-europe.com/support/product-security/ | vendor-advisory |
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Canon Inc. | Generic Plus PCL6 Printer Driver |
Affected:
3.30 and earlier
|
|
| Canon Inc. | Generic Plus UFR II Printer Driver |
Affected:
3.30 and earlier
|
|
| Canon Inc. | Generic Plus LIPS4 Printer Driver |
Affected:
3.30 and earlier
|
|
| Canon Inc. | Generic Plus LIPSLX Printer Driver |
Affected:
3.30 and earlier
|
|
| Canon Inc. | Generic Plus PS Printer Driver |
Affected:
3.30 and earlier
|
|
| Canon Inc. | UFRII LT Printer Driver |
Affected:
31.05 and earlier
|
|
| Canon Inc. | CARPS2 Printer Driver |
Affected:
31.05 and earlier
|
|
| Canon Inc. | Generic FAX Driver |
Affected:
10.67 and earlier
|
|
| Canon Inc. | LIPS4 Printer Driver |
Affected:
15.00 and earlier
|
|
| Canon Inc. | LIPSLX Printer Driver |
Affected:
15.00 and earlier
|
|
| Canon Inc. | UFR II Printer Driver |
Affected:
15.00 and earlier
|
|
| Canon Inc. | PS Printer Driver |
Affected:
15.00 and earlier
|
|
| Canon Inc. | PCL6 Printer Driver |
Affected:
15.00 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9903",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-29T11:55:46.509263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-29T11:56:21.301Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Generic Plus PCL6 Printer Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "3.30 and earlier"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Generic Plus UFR II Printer Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "3.30 and earlier"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Generic Plus LIPS4 Printer Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "3.30 and earlier"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Generic Plus LIPSLX Printer Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "3.30 and earlier"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Generic Plus PS Printer Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "3.30 and earlier"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UFRII LT Printer Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "31.05 and earlier"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CARPS2 Printer Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "31.05 and earlier"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Generic FAX Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "10.67 and earlier"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LIPS4 Printer Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "15.00 and earlier"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LIPSLX Printer Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "15.00 and earlier"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UFR II Printer Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "15.00 and earlier"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PS Printer Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "15.00 and earlier"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PCL6 Printer Driver",
"vendor": "Canon Inc.",
"versions": [
{
"status": "affected",
"version": "15.00 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Out-of-bounds write vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / Generic FAX Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver"
}
],
"value": "Out-of-bounds write vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / Generic FAX Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-15T23:37:40.864Z",
"orgId": "f98c90f0-e9bd-4fa7-911b-51993f3571fd",
"shortName": "Canon"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.canon/advisory-information/cp2025-005/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://canon.jp/support/support-info/250925vulnerability-response"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.usa.canon.com/about-us/to-our-customers/cp2025-005-vulnerabilities-remediation-for-certain-printer-drivers-for-production-printers-office-small-office-multifunction-printers-laser-printers"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.canon-europe.com/support/product-security/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f98c90f0-e9bd-4fa7-911b-51993f3571fd",
"assignerShortName": "Canon",
"cveId": "CVE-2025-9903",
"datePublished": "2025-09-29T00:44:55.506Z",
"dateReserved": "2025-09-03T07:03:46.601Z",
"dateUpdated": "2026-03-15T23:37:40.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9809 (GCVE-0-2025-9809)
Vulnerability from cvelistv5 – Published: 2025-09-01 18:38 – Updated: 2025-09-03 20:29
VLAI
EPSS
VEX
Summary
Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary code via a crafted .cue file with a file path exceeding PATH_MAX_LENGTH that is copied using memcpy into a fixed-size buffer.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| libretro | libretro-common |
Affected:
0
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9809",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-03T20:29:10.518670Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-03T20:29:21.013Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"modules": [
"cdfs_open_cue_track"
],
"product": "libretro-common",
"programFiles": [
"libretro-common/formats/cdfs/cdfs.c"
],
"vendor": "libretro",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Simcha Kosman"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Out-of-bounds write in \u003ccode\u003ecdfs_open_cue_track\u003c/code\u003e in libretro \u003ccode\u003elibretro-common\u003c/code\u003e latest on all platforms allows remote attackers to execute arbitrary code via a crafted \u003ccode\u003e.cue\u003c/code\u003e file with a file path exceeding \u003ccode\u003ePATH_MAX_LENGTH\u003c/code\u003e that is copied using \u003ccode\u003ememcpy\u003c/code\u003e into a fixed-size buffer."
}
],
"value": "Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary code via a crafted .cue file with a file path exceeding PATH_MAX_LENGTH that is copied using memcpy into a fixed-size buffer."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-01T18:38:22.165Z",
"orgId": "96148269-fe82-4198-b1bf-3a73ce8bc92e",
"shortName": "CyberArk"
},
"references": [
{
"url": "https://github.com/libretro/libretro-common/blob/master/formats/cdfs/cdfs.c#L471"
},
{
"url": "https://github.com/libretro/libretro-common/issues/222"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Limit memcpy size to PATH_MAX_LENGTH-1 when copying file paths, ensure explicit NUL-termination, and validate lengths before copy; update to a version including the fix once available.\n\n\u003cbr\u003e"
}
],
"value": "Limit memcpy size to PATH_MAX_LENGTH-1 when copying file paths, ensure explicit NUL-termination, and validate lengths before copy; update to a version including the fix once available."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "96148269-fe82-4198-b1bf-3a73ce8bc92e",
"assignerShortName": "CyberArk",
"cveId": "CVE-2025-9809",
"datePublished": "2025-09-01T18:38:22.165Z",
"dateReserved": "2025-09-01T18:17:00.403Z",
"dateUpdated": "2025-09-03T20:29:21.013Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-9456 (GCVE-0-2025-9456)
Vulnerability from cvelistv5 – Published: 2025-12-15 23:36 – Updated: 2026-05-08 18:25
VLAI
EPSS
VEX
Title
SLDPRT File Parsing Memory Corruption Vulnerability
Summary
A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Shared Components |
Affected:
1.8.0.7 , < 1.9.0.7
(custom)
cpe:2.3:a:autodesk:shared_components:1.8.0.7:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9456",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-17T04:56:02.794589Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T16:07:38.729Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:shared_components:1.8.0.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Shared Components",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "1.9.0.7",
"status": "affected",
"version": "1.8.0.7",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.\u003cbr\u003e"
}
],
"value": "A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T18:25:08.652Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0024"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SLDPRT File Parsing Memory Corruption Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2025-9456",
"datePublished": "2025-12-15T23:36:32.898Z",
"dateReserved": "2025-08-25T14:12:51.594Z",
"dateUpdated": "2026-05-08T18:25:08.652Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9452 (GCVE-0-2025-9452)
Vulnerability from cvelistv5 – Published: 2025-12-15 23:32 – Updated: 2026-05-08 18:23
VLAI
EPSS
VEX
Title
SLDPRT File Parsing Memory Corruption Vulnerability
Summary
A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Shared Components |
Affected:
1.8.0.7 , < 1.9.0.7
(custom)
cpe:2.3:a:autodesk:shared_components:1.8.0.7:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-17T04:55:54.966024Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T16:07:39.539Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:shared_components:1.8.0.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Shared Components",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "1.9.0.7",
"status": "affected",
"version": "1.8.0.7",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.\u003cbr\u003e"
}
],
"value": "A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T18:23:07.475Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0024"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SLDPRT File Parsing Memory Corruption Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2025-9452",
"datePublished": "2025-12-15T23:32:39.490Z",
"dateReserved": "2025-08-25T14:12:49.013Z",
"dateUpdated": "2026-05-08T18:23:07.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9340 (GCVE-0-2025-9340)
Vulnerability from cvelistv5 – Published: 2025-08-22 09:39 – Updated: 2025-08-22 10:37
VLAI
EPSS
VEX
Title
native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output.
Summary
Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All (API modules). This vulnerability is associated with program files org/bouncycastle/jcajce/provider/BaseCipher.
This issue affects Bouncy Castle for Java: from BC-FJA 2.1.0 through 2.1.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Legion of the Bouncy Castle Inc. | Bouncy Castle for Java |
Affected:
BC-FJA 2.1.0 , ≤ 2.1.0
(maven)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9340",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-22T10:37:04.005071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T10:37:18.585Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/org/bouncycastle",
"defaultStatus": "unaffected",
"modules": [
"API"
],
"packageName": "bc-fips",
"platforms": [
"All"
],
"product": "Bouncy Castle for Java",
"programFiles": [
"org/bouncycastle/jcajce/provider/BaseCipher"
],
"repo": "ssh://bcgit@git.bouncycastle.org:bc-fips-2.1.X-java.git",
"vendor": "Legion of the Bouncy Castle Inc.",
"versions": [
{
"lessThanOrEqual": "2.1.0",
"status": "affected",
"version": "BC-FJA 2.1.0",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All (API modules).\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003eorg/bouncycastle/jcajce/provider/BaseCipher\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects Bouncy Castle for Java: from BC-FJA 2.1.0 through 2.1.0.\u003c/p\u003e"
}
],
"value": "Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All (API modules). This vulnerability is associated with program files org/bouncycastle/jcajce/provider/BaseCipher.\n\nThis issue affects Bouncy Castle for Java: from BC-FJA 2.1.0 through 2.1.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "USER",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "PHYSICAL",
"baseScore": 0,
"baseSeverity": "NONE",
"privilegesRequired": "LOW",
"providerUrgency": "GREEN",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/R:U/RE:M/U:Green",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T09:39:47.303Z",
"orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
"shortName": "bcorg"
},
"references": [
{
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%909340"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output.",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This can be coded around by avoiding operations in place when dealing with aes-native encryption/decryption."
}
],
"value": "This can be coded around by avoiding operations in place when dealing with aes-native encryption/decryption."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
"assignerShortName": "bcorg",
"cveId": "CVE-2025-9340",
"datePublished": "2025-08-22T09:39:47.303Z",
"dateReserved": "2025-08-22T08:45:05.505Z",
"dateUpdated": "2025-08-22T10:37:18.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-9275 (GCVE-0-2025-9275)
Vulnerability from cvelistv5 – Published: 2025-09-02 20:00 – Updated: 2025-09-03 15:34
VLAI
EPSS
VEX
Title
Oxford Instruments Imaris Viewer IMS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Summary
Oxford Instruments Imaris Viewer IMS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oxford Instruments Imaris Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of IMS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21655.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Oxford Instruments | Imaris Viewer |
Affected:
10.0.1
|
Date Public
2025-08-20 22:03
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9275",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-03T15:33:59.407102Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-03T15:34:05.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Imaris Viewer",
"vendor": "Oxford Instruments",
"versions": [
{
"status": "affected",
"version": "10.0.1"
}
]
}
],
"dateAssigned": "2025-08-20T18:14:12.836Z",
"datePublic": "2025-08-20T22:03:21.548Z",
"descriptions": [
{
"lang": "en",
"value": "Oxford Instruments Imaris Viewer IMS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oxford Instruments Imaris Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of IMS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21655."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-02T20:00:41.647Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-854",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-854/"
}
],
"source": {
"lang": "en",
"value": "rgod"
},
"title": "Oxford Instruments Imaris Viewer IMS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-9275",
"datePublished": "2025-09-02T20:00:41.647Z",
"dateReserved": "2025-08-20T18:14:12.807Z",
"dateUpdated": "2025-09-03T15:34:05.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-9242 (GCVE-0-2025-9242)
Vulnerability from cvelistv5 – Published: 2025-09-17 07:29 – Updated: 2026-02-26 17:48
VLAI
EPSS
VEX
Title
WatchGuard Firebox iked Out of Bounds Write Vulnerability
Summary
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1.
Severity
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.watchguard.com/wgrd-psirt/advisory/wg… | |
| https://github.com/watchtowrlabs/watchTowr-vs-Wat… | exploit |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WatchGuard | Fireware OS |
Affected:
12.0 , ≤ 12.11.3
(semver)
Affected: 11.10.2 , ≤ 11.12.4+541730 (semver) Affected: 2025.0 , ≤ 2025.1 (semver) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9242",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-11T04:55:33.935049Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-11-12",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:48:28.750Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-12T00:00:00.000Z",
"value": "CVE-2025-9242 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Fireware OS",
"vendor": "WatchGuard",
"versions": [
{
"lessThanOrEqual": "12.11.3",
"status": "affected",
"version": "12.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.12.4+541730",
"status": "affected",
"version": "11.10.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "2025.1",
"status": "affected",
"version": "2025.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.0",
"versionEndIncluding": "12.11.3",
"versionStartIncluding": "12.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:11.10.2",
"versionEndIncluding": "11.12.4+541730",
"versionStartIncluding": "11.10.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:2025.0",
"versionEndIncluding": "2025.1",
"versionStartIncluding": "2025.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "btaol"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.\u003cp\u003eThis vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1.\u003c/p\u003e"
}
],
"value": "An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1."
}
],
"impacts": [
{
"capecId": "CAPEC-253",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-253 Remote Code Inclusion"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-14T22:30:31.226Z",
"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"shortName": "WatchGuard"
},
"references": [
{
"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015"
}
],
"source": {
"advisory": "WGSA-2025-00015",
"defect": [
"FBX-30275"
],
"discovery": "EXTERNAL"
},
"title": "WatchGuard Firebox iked Out of Bounds Write Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"assignerShortName": "WatchGuard",
"cveId": "CVE-2025-9242",
"datePublished": "2025-09-17T07:29:23.738Z",
"dateReserved": "2025-08-20T11:08:20.724Z",
"dateUpdated": "2026-02-26T17:48:28.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9230 (GCVE-0-2025-9230)
Vulnerability from cvelistv5 – Published: 2025-09-30 13:17 – Updated: 2026-07-14 12:39
VLAI
EPSS
VEX
Title
Out-of-bounds read & write in RFC 3211 KEK Unwrap
Summary
Issue summary: An application trying to decrypt CMS messages encrypted using
password based encryption can trigger an out-of-bounds read and write.
Impact summary: This out-of-bounds read may trigger a crash which leads to
Denial of Service for an application. The out-of-bounds write can cause
a memory corruption which can have various consequences including
a Denial of Service or Execution of attacker-supplied code.
Although the consequences of a successful exploit of this vulnerability
could be severe, the probability that the attacker would be able to
perform it is low. Besides, password based (PWRI) encryption support in CMS
messages is very rarely used. For that reason the issue was assessed as
Moderate severity according to our Security Policy.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as the CMS implementation is outside the OpenSSL FIPS module
boundary.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
17 references
Impacted products
25 products
| Vendor | Product | Version | |
|---|---|---|---|
| OpenSSL | OpenSSL |
Affected:
3.5.0 , < 3.5.4
(semver)
Affected: 3.4.0 , < 3.4.3 (semver) Affected: 3.3.0 , < 3.3.5 (semver) Affected: 3.2.0 , < 3.2.6 (semver) Affected: 3.0.0 , < 3.0.18 (semver) Affected: 1.1.1 , < 1.1.1zd (custom) Affected: 1.0.2 , < 1.0.2zm (custom) |
|
| Siemens | RUGGEDCOM RST2428P |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | RUGGEDCOM RST2428P |
Affected:
0 , < V4.0
(custom)
|
|
| Siemens | SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XCH328 |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XCM324 |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XCM328 |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XCM332 |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XRH334 (24 V DC, 8xFO, CC) |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XRM334 (230 V AC, 12xFO) |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XRM334 (230 V AC, 8xFO) |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XRM334 (24 V DC, 12xFO) |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XRM334 (24 V DC, 8xFO) |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XRM334 (2x230 V AC, 12xFO) |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XRM334 (2x230 V AC, 8xFO) |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) |
Affected:
0 , < V3.3
(custom)
|
|
| Siemens | SIDIS Prime |
Affected:
0 , < V4.0.800
(custom)
|
|
| Siemens | SIDIS Secured SmartPlug |
Affected:
0 , < V7.26.0310
(custom)
|
|
| Siemens | SIMATIC CN 4100 |
Affected:
0 , < V5.0
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem |
Affected:
0 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
Date Public
2025-09-30 14:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-9230",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-30T19:30:08.302408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-30T19:30:29.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:15:17.295Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/09/30/5"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST2428P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST2428P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XCH328",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XCM324",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XCM328",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XCM332",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XRM334 (230 V AC, 12xFO)",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XRM334 (230 V AC, 8xFO)",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XRM334 (24 V DC, 12xFO)",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XRM334 (24 V DC, 8xFO)",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIDIS Prime",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.0.800",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIDIS Secured SmartPlug",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V7.26.0310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC CN 4100",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:39:16.299Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-585531.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenSSL",
"vendor": "OpenSSL",
"versions": [
{
"lessThan": "3.5.4",
"status": "affected",
"version": "3.5.0",
"versionType": "semver"
},
{
"lessThan": "3.4.3",
"status": "affected",
"version": "3.4.0",
"versionType": "semver"
},
{
"lessThan": "3.3.5",
"status": "affected",
"version": "3.3.0",
"versionType": "semver"
},
{
"lessThan": "3.2.6",
"status": "affected",
"version": "3.2.0",
"versionType": "semver"
},
{
"lessThan": "3.0.18",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
},
{
"lessThan": "1.1.1zd",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
},
{
"lessThan": "1.0.2zm",
"status": "affected",
"version": "1.0.2",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Stanislav Fort (Aisle Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Stanislav Fort (Aisle Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Viktor Dukhovni"
}
],
"datePublic": "2025-09-30T14:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Issue summary: An application trying to decrypt CMS messages encrypted using\u003cbr\u003epassword based encryption can trigger an out-of-bounds read and write.\u003cbr\u003e\u003cbr\u003eImpact summary: This out-of-bounds read may trigger a crash which leads to\u003cbr\u003eDenial of Service for an application. The out-of-bounds write can cause\u003cbr\u003ea memory corruption which can have various consequences including\u003cbr\u003ea Denial of Service or Execution of attacker-supplied code.\u003cbr\u003e\u003cbr\u003eAlthough the consequences of a successful exploit of this vulnerability\u003cbr\u003ecould be severe, the probability that the attacker would be able to\u003cbr\u003eperform it is low. Besides, password based (PWRI) encryption support in CMS\u003cbr\u003emessages is very rarely used. For that reason the issue was assessed as\u003cbr\u003eModerate severity according to our Security Policy.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\u003cbr\u003eissue, as the CMS implementation is outside the OpenSSL FIPS module\u003cbr\u003eboundary."
}
],
"value": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."
}
],
"metrics": [
{
"format": "other",
"other": {
"content": {
"text": "Moderate"
},
"type": "https://openssl-library.org/policies/general/security-policy/"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-30T13:17:00.808Z",
"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"shortName": "openssl"
},
"references": [
{
"name": "OpenSSL Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://openssl-library.org/news/secadv/20250930.txt"
},
{
"name": "3.5.4 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482"
},
{
"name": "3.4.3 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280"
},
{
"name": "3.3.5 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45"
},
{
"name": "3.2.6 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd"
},
{
"name": "3.0.18 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def"
},
{
"name": "1.1.1zd git commit",
"tags": [
"patch"
],
"url": "https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba"
},
{
"name": "1.0.2zm git commit",
"tags": [
"patch"
],
"url": "https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"assignerShortName": "openssl",
"cveId": "CVE-2025-9230",
"datePublished": "2025-09-30T13:17:00.808Z",
"dateReserved": "2025-08-20T08:38:07.678Z",
"dateUpdated": "2026-07-14T12:39:16.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-3
Requirements
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer.
- Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
Mitigation MIT-4.1
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation MIT-9
Implementation
- Consider adhering to the following rules when allocating and managing an application's memory:
- Double check that the buffer is as large as specified.
- When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string.
- Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.
- If necessary, truncate all input strings to a reasonable length before passing them to the copy and concatenation functions.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation MIT-12
Operation
Strategy: Environment Hardening
- Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment.
- For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
Mitigation MIT-13
Implementation
Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.
No CAPEC attack patterns related to this CWE.