CVE-2022-1891: Lenovo Thinkbook 14-Iil Firmware

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.

Affected products

• Lenovo Thinkbook 14-Iil Firmware: before djcn28ww (fixed in djcn28ww)
• Lenovo Thinkbook 14-Iml Firmware: before cjcn38ww (fixed in cjcn38ww)
• Lenovo Thinkbook 15-Iil Firmware: before djcn28ww (fixed in djcn28ww)
• Lenovo Thinkbook 15-Iml Firmware: before cjcn38ww (fixed in cjcn38ww)
• Lenovo Yoga c640-13iml Firmware: before chcn28ww (fixed in chcn28ww)
• Lenovo Yoga c640-13iml Lte Firmware: before chcn28ww (fixed in chcn28ww)

Published 2023-01-26. Last modified 2026-06-17.