Lenovo BIOS CVE-2026-10587

Exploitation requires local access to the affected device with high OS-level privileges (administrator on Windows or root on Linux), as confirmed by CVSS 4.0 AV:L and PR:H. The vulnerable code path resides in the BIOS power management SMM handler - the attacker must be able to trigger SMM entry through a privileged software interface. No network access path exists; the attack is purely local. Limiting factors include: (1) physical or authenticated local session access is required, (2) high OS privileges must be held before any BIOS interaction is possible, (3) the flaw is present only in the specific Lenovo laptop BIOS models identified in the CPE data - not all Lenovo devices or BIOS implementations. These constraints mean exploitation is a post-compromise persistence technique, not an initial intrusion vector.

The CVSS 4.0 score of 6.8 with vector AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N accurately captures the risk profile. The local attack vector (AV:L) and high privilege requirement (PR:H) are the dominant risk limiters - an attacker must already have administrator or root access to the OS before any BIOS-level exploitation is possible, placing this firmly in the post-compromise persistence category rather than an initial access or lateral movement vector. Low attack complexity (AC:L) and no required user interaction (UI:N) mean that once privileges are obtained, the exploitation path is straightforward. Integrity and availability impacts are high (VI:H/VA:H), reflecting the potential to permanently alter firmware behavior or render the system unbootable. No confidentiality impact is noted. No EPSS score was provided. No KEV listing exists and no public POC has been identified, consistent with the high privilege bar limiting opportunistic exploitation. The absence of a subsequent system scope change (SC:N) in the vendor vector is notable - it suggests the vendor did not assess a full SMM breakout to hypervisor or other downstream systems, though SMM-level corruption carries implicit risk beyond the BIOS component alone.

An attacker who has already compromised a target Lenovo laptop with administrator or root-level OS privileges executes a crafted payload that interfaces with the BIOS power management SMM handler, triggering an out-of-bounds write that corrupts SMRAM contents. By manipulating SMM execution flow, the attacker installs a persistent firmware-level implant that survives full OS reinstallation and cannot be detected or removed by OS-layer security tools. No public proof-of-concept has been identified at time of analysis.