Lenovo BIOS CVE-2026-10588

Exploitation requires physical or logical local access to an affected Lenovo laptop with a vulnerable BIOS version, and the attacker must already hold high operating-system privileges (administrator on Windows or root on Linux), consistent with CVSS PR:H. No special non-default configuration is required - the vulnerability exists in the default BIOS of affected models. Exploitation is limited to the specific Lenovo consumer and business laptop models listed in the advisory; desktop, server, and ThinkPad product lines are not mentioned in the available CPE data. There is no remote attack vector (AV:L), no user interaction requirement, and no additional attack-preparation complexity (AC:L/AT:N). The key limiting factor is the mandatory local high-privilege pre-condition, which rules out opportunistic or remote exploitation.

The CVSS 4.0 score of 6.7 (Medium) is consistent with the attack profile: local access and high privileges (PR:H) are mandatory, meaning an attacker must already have administrative or root-level OS control before this vulnerability can be leveraged. The sole impact is confidentiality (VC:H) - no integrity or availability impact is reported. EPSS data is not available in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no public proof-of-concept is identified. Despite the moderate CVSS score, the security significance should not be dismissed: SMRAM address disclosure is frequently the first step in a multi-stage firmware attack chain. Defenders on affected hardware who operate in high-assurance or government environments - where firmware-level persistence is a threat model concern - should treat this with higher urgency than the numeric score alone suggests. For typical enterprise endpoints, the PR:H pre-requisite dramatically limits opportunistic exploitation, and this is a lower-priority patching item compared to remotely exploitable vulnerabilities.

An attacker who has already obtained administrator or root-level access on a Lenovo laptop (via credential theft, privilege escalation exploit, or malicious insider) uses this vulnerability to query or observe SMRAM base addresses through a vulnerable BIOS interface. With the SMRAM layout now known, the attacker can defeat firmware-level ASLR and target specific SMM handler code locations in a follow-on SMM exploitation attempt to implant a persistent firmware rootkit that survives OS reinstallation. No public proof-of-concept code is identified at time of analysis.