CVE-2022-40136 MEDIUM

CVE-2022-40136

Vendor Lenovo

Product BIOS

Weakness CWE-125

Published January 30, 2023

Last update March 27, 2025

View on NVD All CVEs

CVSS base score

4.4/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.

Key dates

02Disclosure timeline

January 30, 2023 CVE published

March 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-40136 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/125.html

Related vulnerabilities

04Related CVE

CVE-2019-6765 CVE-2025-42976 Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document) CVE-2026-45608 Windows DHCP Client Information Disclosure Vulnerability CVE-2026-10233 Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_sequence_infos out-of-bounds CVE-2025-5166 Open Asset Import Library Assimp MDC File Parser MDCLoader.cpp InternReadFile out-of-bounds