CVE-2022-1891 - A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code

Back Back to CVE browser

HIGH

A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code

Published Jan 23, 2023

7.8

HIGH

CVSS 3.1

EPSS 0.34%

Description

A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.

Affected products

Vendor Lenovo Product BIOS Default
unaffected
- Version
  various
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Lenovo

BIOS

unaffected

Version	Status	Constraints
various	affected	-

Remediation

Vendor solution

Update system firmware to the version (or newer) indicated for your model in the product Impact section of LEN-91369

Weaknesses (2)

CWE-120

Classic Buffer Overflow

CWE-122

References (1)

https://support.lenovo.com/us/en/product_security/LEN-91369
Vendor Advisory

Link	Providers	Tags
https://support.lenovo.com/us/en/product_security/LEN-91369		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner lenovo

Published Jan 23, 2023

Updated Apr 3, 2025

Reserved May 25, 2022

Link CVE-2022-1891

CISA Vulnrichment

Updated Apr 2, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-1891

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-1891