EUVD-2026-44979
GHSA-rmm6-xmjx-84r5
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and high privileges required to reach SMM handler; no confidentiality impact; integrity and availability high due to potential SMRAM corruption; scope unchanged per vendor's own subsequent-system assessment.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
2DescriptionCVE.org
A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode.
AnalysisAI
Out-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local privileged attacker to corrupt power management settings within System Management Mode, a CPU execution context operating below the OS kernel at Ring -2. Successful exploitation could allow persistent firmware-level tampering that survives OS reinstalls and reboots. No public exploit has been identified at time of analysis, and exploitation requires pre-existing high OS-level privileges, substantially limiting real-world risk to post-compromise scenarios.
Technical ContextAI
System Management Mode is a special-purpose CPU operating mode invoked by BIOS/UEFI firmware to handle low-level tasks including power management, hardware initialization, and thermal control. SMM code runs at a privilege level above the OS kernel (Ring -2), meaning OS-level security controls cannot inspect or restrict its execution. The vulnerability - tagged as a Buffer Overflow - exists in the SMM power management handler within Lenovo's proprietary BIOS firmware. An out-of-bounds write in this context could corrupt adjacent SMRAM contents, overwrite SMM handler code, or alter power management configuration data in ways the OS cannot detect or remediate. Affected CPE strings identify BIOS firmware across Lenovo's Yoga Pro, Yoga Book, IdeaPad Pro, Legion, Legion Pro, LOQ, ThinkBook Plus, and V-series models, covering both Intel (IPH, IAH, IRH, IRL, IRX) and AMD (AGP, AFP, ARP) platform variants. No CWE was assigned by the reporter.
RemediationAI
The primary fix is to apply updated BIOS firmware from Lenovo for each affected model; exact patched firmware version numbers must be retrieved per-device from the Lenovo product security advisory at https://support.lenovo.com/us/en/product_security/LEN-220440, as versions differ across the extensive model list. Patch available per vendor advisory. Until the BIOS update is applied, compensating controls should focus on reducing the likelihood of an attacker reaching the required privilege level: enforce strict endpoint privilege management (EPM) to prevent unauthorized elevation to administrator or root on affected systems, audit and restrict physical access to devices, and monitor for unexpected privilege escalation events via EDR tooling. Note that this vulnerability cannot be mitigated through OS patches, antivirus, or network controls - only a BIOS firmware update eliminates the root cause. Organizations with high-value assets on affected Lenovo laptop models should prioritize BIOS patching to prevent post-compromise firmware persistence.
More in Yoga Pro 7 15Iph11 Bios
View allOut-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local attacker
Lenovo BIOS firmware across dozens of consumer and gaming laptop models - Legion, IdeaPad, Yoga, ThinkBook, LOQ, and V-s
SMM memory address disclosure in Lenovo laptop BIOS firmware exposes the location of protected System Management Mode (S
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today