CVE-2025-4421 is a memory corruption in SMM’s CPU protocol service that allows attackers to write data beyond allocated memory boundaries, potentially overwriting critical system code. Out-of-bounds write vulnerability CVE-2025-4422 in SMM’s platform configuration database protocol, enabling attackers to corrupt memory and execute malicious code. Six BIOS vulnerabilities let attackers execute malicious code on Lenovo systems. Information disclosure vulnerability CVE-2025-4426 that leaks sensitive data from protected system management memory (SMRAM) to unauthorized processes. Input validation flaw CVE-2025-4424 allows attackers to make unauthorized calls to system variable functions with malicious parameters, potentially altering system configuration. Additionally, buffer overflow CVE-2025-4423 in the setup automation module lets attackers inject and execute arbitrary code within the highly privileged SMM environment. Stack-based buffer overflow CVE-2025-4425 in system interrupt handlers that can be exploited to overwrite return addresses and execute attacker-controlled code. The vulnerabilities affect InsydeH2O BIOS implementations used in specific Lenovo desktop and all-in-one computer models, with CVSS scores ranging from 6.0 to 8.2, indicating high severity risks. The BINARLY Research team, credited with discovering these vulnerabilities through coordinated disclosure, emphasizes the critical nature of these SMM-level security flaws. However, remediation timelines for Yoga AIO systems extend through late 2025, with fixes scheduled for September 30, 2025 (Yoga AIO 32ILL10 and 9 32IRH8) and November 30, 2025 (Yoga AIO 27IAH10). All vulnerabilities require high privileges (local admin access) to exploit, but can lead to complete system compromise once executed.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 31 Jul 2025 13:50:24 +0000