EUVD-2026-44981
GHSA-pwmv-8h46-f444
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SMM execution crosses the OS security scope boundary (S:C); from SMM, all system memory is readable and writable, yielding C:H/I:H/A:H despite Lenovo's conservative VC:N.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode.
AnalysisAI
Out-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local attacker with high OS-level privileges to execute arbitrary code in System Management Mode (SMM) - a CPU execution context operating below the operating system and hypervisor with access to all system memory. Successful exploitation allows persistent firmware-level implants that survive OS reinstallation and defeat Secure Boot and standard endpoint detection tools. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have achieved local OS-level administrator (Windows) or root (Linux) privileges on an affected Lenovo device running unpatched BIOS firmware - confirming CVSS PR:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Lenovo's CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N) scores 6.8 and reflects local exploitation requiring high OS-level privileges with low complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor who has already achieved OS administrator or root-level access on an affected Lenovo laptop crafts a malicious SMI (System Management Interrupt) call or manipulates data structures inspected by the vulnerable SMM handler, triggering an out-of-bounds write that overwrites code or function pointers within SMRAM. This redirects SMM execution to attacker-controlled shellcode running at a privilege level below the OS kernel, from which the attacker can read all system memory, modify UEFI firmware variables, or implant a firmware rootkit that persists through OS reinstallation and evades endpoint detection tools. … |
| Remediation | The primary remediation is to apply the BIOS firmware update released by Lenovo for each affected model. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Yoga Pro 7 15Iph11 Bios
View allOut-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local privilege
Lenovo BIOS firmware across dozens of consumer and gaming laptop models - Legion, IdeaPad, Yoga, ThinkBook, LOQ, and V-s
SMM memory address disclosure in Lenovo laptop BIOS firmware exposes the location of protected System Management Mode (S
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today