Lenovo BIOS Firmware CVE-2026-10589

Exploitation requires the attacker to have achieved local OS-level administrator (Windows) or root (Linux) privileges on an affected Lenovo device running unpatched BIOS firmware - confirming CVSS PR:H. The attack is delivered by executing privileged ring-0 code capable of issuing SMI calls or manipulating SMM-visible data structures, which is only accessible from an already-elevated OS context. Unprivileged local users and remote attackers without prior local code execution capability cannot trigger this vulnerability. Exploitation is constrained to the specific hardware models listed in the CPE data; unaffected Lenovo models or non-Lenovo hardware are not impacted. Secure Boot is not a limiting factor, as SMM operates beneath the Secure Boot enforcement layer. No non-default configuration setting is required - the flaw exists in the BIOS firmware as shipped on affected hardware.

Lenovo's CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N) scores 6.8 and reflects local exploitation requiring high OS-level privileges with low complexity. This score likely understates real-world severity: SMM code execution intrinsically grants read/write access to all system memory including OS kernel and hypervisor memory, making VC:N inconsistent with actual SMM semantics - confidentiality impact is inferred to exist even if not reflected in Lenovo's conservative CVSS assignment. The SC:N/SI:N/SA:N (no subsequent-system impact) is also arguably inconsistent with SMM's capability to modify firmware, persist across OS reinstalls, and undermine platform trust. No EPSS data was provided, and there is no CISA KEV listing or public exploit code at time of analysis. The high-privilege prerequisite (PR:H) significantly limits opportunistic exploitation; however, in targeted intrusions against high-value individuals (executives, government, defense), an adversary who already holds OS admin access could leverage this flaw for persistence that defeats standard incident response. The absence of POC and KEV listing suggests this is not currently being mass-exploited but remains a priority for environments with elevated threat models.

A threat actor who has already achieved OS administrator or root-level access on an affected Lenovo laptop crafts a malicious SMI (System Management Interrupt) call or manipulates data structures inspected by the vulnerable SMM handler, triggering an out-of-bounds write that overwrites code or function pointers within SMRAM. This redirects SMM execution to attacker-controlled shellcode running at a privilege level below the OS kernel, from which the attacker can read all system memory, modify UEFI firmware variables, or implant a firmware rootkit that persists through OS reinstallation and evades endpoint detection tools. No public exploit code has been identified at time of analysis.