EUVD-2026-44980
GHSA-vr8x-qg62-cfwr
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector, high privileges mandatory to access BIOS SMM interface; sole impact is confidentiality via SMRAM address disclosure.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
2DescriptionCVE.org
A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory.
AnalysisAI
SMM memory address disclosure in Lenovo laptop BIOS firmware exposes the location of protected System Management Mode (SMRAM) regions to a local privileged attacker. Dozens of Lenovo consumer, gaming, and business laptop product lines are affected across IdeaPad, Legion, Yoga, ThinkBook, LOQ, and V-series models. While the direct impact is confidentiality-only, SMRAM address disclosure is a classic prerequisite step in firmware-level attack chains that seek to bypass address-space protections and ultimately plant persistent SMM rootkits. No public exploit has been identified at time of analysis, and exploitation is not confirmed in CISA KEV.
Technical ContextAI
System Management Mode (SMM) is a special-purpose x86/x64 CPU execution ring (Ring -2) used exclusively by UEFI/BIOS firmware for platform management tasks such as power control, hardware error handling, and secure features. SMM code and data reside in a dedicated, hardware-protected memory region called SMRAM, which is invisible and inaccessible to the operating system and hypervisors during normal execution. Disclosing the base address of SMRAM undermines firmware-level address space layout randomization (ASLR), which is a key mitigation against SMM exploits. The CPE data confirms that the affected components are BIOS firmware images across more than 50 distinct Lenovo laptop model lines (Yoga Pro, IdeaPad Pro, Legion, Legion Pro, ThinkBook, LOQ, Yoga Book, Lenovo V-series). No CWE is assigned in the source data, but the root-cause class is best described as an improper restriction of information leak from privileged firmware (analogous to CWE-200 or CWE-1264 - improper access control for register interface). The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:H/UI:N confirms a local, high-privilege attack requiring no special configuration or user interaction.
RemediationAI
The primary remediation is to apply the BIOS firmware update for the affected device, as directed by Lenovo security advisory LEN-220440 (https://support.lenovo.com/us/en/product_security/LEN-220440). Specific patched BIOS version numbers are not included in the current source data; users should visit the Lenovo support page for their exact model to obtain the correct firmware image and follow Lenovo's flashing instructions carefully, as an interrupted BIOS update can brick the device. As a compensating control where patching is not immediately feasible, organizations can restrict local administrative access on affected endpoints to reduce the pool of users who could reach the PR:H threshold required for exploitation. Enabling and enforcing Secure Boot does not directly mitigate SMRAM address disclosure but reduces the value of the information to an attacker by limiting their ability to execute unsigned SMM payloads in subsequent attack stages. There are no known software-only workarounds that fully eliminate this exposure short of the vendor BIOS update.
More in Yoga Pro 7 15Iph11 Bios
View allOut-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local attacker
Out-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local privilege
Lenovo BIOS firmware across dozens of consumer and gaming laptop models - Legion, IdeaPad, Yoga, ThinkBook, LOQ, and V-s
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today