CVE-2024-3100: Lenovo 100w Gen 3 Firmware

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated privileges to execute arbitrary code.

Affected products

• Lenovo 100w Gen 3 Firmware
• Lenovo 100w Gen 3 Laptop Lenovo BIOS
• Lenovo 100w Gen 4 Laptop Lenovo BIOS
• Lenovo 13w Yoga Firmware
• Lenovo 13w Yoga Gen 2 Firmware
• Lenovo 13w Yoga Gen 2 Type 82yr, 82ys Laptop Lenovo BIOS
• Lenovo 13w Yoga Type 82s1, 82s2 Laptop Lenovo BIOS
• Lenovo 14w Gen 2 Firmware: before h0cn29ww (fixed in h0cn29ww)
• Lenovo 14w Gen 2 Laptop Lenovo BIOS: before H0CN29WW (fixed in H0CN29WW)
• Lenovo 300w Gen 3 Laptop Lenovo BIOS
• Lenovo 300w Yoga Gen 4 Laptop Lenovo BIOS
• Lenovo 500w Yoga Gen 4 Firmware: before l2cn34ww (fixed in l2cn34ww); before l3cn34ww (fixed in l3cn34ww)
• Lenovo 500w Yoga Gen 4 Laptop Lenovo BIOS
• Lenovo Flex 5-14itl05 Firmware
• Lenovo Flex 5-14itl05 Laptop Ideapad BIOS
• Lenovo Flex 5-15itl05 Laptop Ideapad BIOS
• Lenovo Ideapad 1-11igl05 Firmware
• Lenovo Ideapad 1-11igl05 Laptop BIOS
• Lenovo Ideapad 1-14igl05 Laptop BIOS
• Lenovo Ideapad 1 14alc7 Laptop BIOS
• Lenovo Ideapad 1 15alc7 Firmware
• Lenovo Ideapad 1 15alc7 Laptop BIOS
• Lenovo Ideapad 3-14alc6 Laptop BIOS
• Lenovo Ideapad 3-15alc6 Laptop BIOS
• Lenovo Ideapad 3-17alc6 Firmware
• and 54 more

Published 2024-09-13. Last modified 2026-06-17.