CVE-2026-0421
Medium · 6.5CVSS
6.5
EPSS
0.2%
Published
Jan 14, 2026
CISA due date
—
The record
A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems where Secure Boot is set to User Mode.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli… CWE-252
- CVE-2026-110353 HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of… CWE-252
- CVE-2026-106436 The BSON encoder in the MongoDB PHP Driver does not check some return values after a… CWE-252
- CVE-2026-86141 xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt… CWE-252
- CVE-2026-19534 undici's WebSocket client crashes the whole Node.js process during the opening handshake… CWE-252
- CVE-2026-85649 (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password… CWE-252
- CVE-2026-14957 In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and… CWE-252
- CVE-2026-78699 Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can… CWE-252