CVE-2023-34419
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products...
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
CVE-2023-34419- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2023-38496
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
EUVD-2023-38496- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x4pq-3h8q-r7jw
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products...
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
GHSA-x4pq-3h8q-r7jw- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
CVE-2023-34419- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
Affected products
- lenovo notebook
- lenovo legion 5-15ach6 firmware
- lenovo legion 5-15ach6a firmware
- lenovo legion 5-15ach6h firmware
- lenovo legion 5-15ith6 firmware
- lenovo legion 5-15ith6h firmware
- lenovo legion 5-17ach6 firmware
- lenovo legion 5-17ach6h firmware
- lenovo legion 5-17ith6 firmware
- lenovo legion 5-17ith6h firmware
- lenovo legion 5 15arh7 firmware
- lenovo legion 5 15arh7h firmware
Show 19 moreShow less
- lenovo legion 5 15iah7 firmware
- lenovo legion 5 15iah7h firmware
- lenovo legion 5 pro-16ach6 firmware
- lenovo legion 5 pro-16ach6h firmware
- lenovo legion 5 pro-16ith6 firmware
- lenovo legion 5 pro-16ith6h firmware
- lenovo legion 5 pro 16arh7 firmware
- lenovo legion 5 pro 16arh7h firmware
- lenovo legion 5 pro 16iah7 firmware
- lenovo legion 5 pro 16iah7h firmware
- lenovo legion 7-16achg6 firmware
- lenovo legion 7-16arha7 firmware
- lenovo legion 7-16ithg6 firmware
- lenovo legion pro 5 16irx8 firmware
- lenovo legion pro 7 16irx8 firmware
- lenovo legion pro 7 16irx8h firmware
- lenovo legion s7 16arha7 firmware
- lenovo thinkbook 15p g2 ith firmware
- lenovo thinkbook 16p g3 arh firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-34419 is a medium vulnerability (CVSS 6.7) in Lenovo Notebook, published August 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. No source names a fixed version.