EUVD-2026-44981
GHSA-pwmv-8h46-f444
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SMM execution crosses the OS security scope boundary (S:C); from SMM, all system memory is readable and writable, yielding C:H/I:H/A:H despite Lenovo's conservative VC:N.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
2DescriptionCVE.org
A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode.
AnalysisAI
Out-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local attacker with high OS-level privileges to execute arbitrary code in System Management Mode (SMM) - a CPU execution context operating below the operating system and hypervisor with access to all system memory. Successful exploitation allows persistent firmware-level implants that survive OS reinstallation and defeat Secure Boot and standard endpoint detection tools. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, SMM code execution represents one of the highest-impact firmware attack primitives available to an advanced threat actor.
Technical ContextAI
System Management Mode (SMM) is a special-purpose x86/x86-64 CPU execution mode used by UEFI firmware for low-level hardware management, power control, and OEM-specific functionality. SMM code runs in System Management RAM (SMRAM), a protected memory region that is intended to be inaccessible from the OS, hypervisor, and even ring-0 kernel code. The vulnerability is an out-of-bounds write (consistent with CWE-787, though CWE is listed N/A; vendor tags classify it as a buffer overflow) in one or more SMM handlers - code that processes System Management Interrupts (SMIs) from the OS layer. A write operation in this handler can exceed its intended buffer boundary, overwriting adjacent memory in or near SMRAM, ultimately allowing attacker-controlled data to redirect SMM execution flow. Per CPE data, affected products span both Intel-platform models (IPH, IRH, IAH, IRX, IAX, IRP, IMH suffixes) and AMD-platform models (AGP, ARP, AKP, AFR suffixes), covering IdeaPad, Yoga, Legion, ThinkBook, LOQ, and Lenovo V-series product lines.
RemediationAI
The primary remediation is to apply the BIOS firmware update released by Lenovo for each affected model. Consult the vendor security advisory at https://support.lenovo.com/us/en/product_security/LEN-220440 for the specific patched firmware version number applicable to each device, as version numbers differ per model. Updates can be applied via Lenovo Vantage (Windows), the Lenovo System Update utility, or manual BIOS flashing from the Lenovo support site; always perform firmware updates on AC power with a charged battery to avoid bricking the device during flash. Exact patched firmware version numbers are not independently verified from the available data - the advisory must be consulted for this. As a compensating control where immediate firmware patching is not feasible, enforce strict least-privilege policies to prevent unauthorized users from gaining OS-level admin or root access, since PR:H is required for exploitation; note this does not eliminate risk if an adversary already holds admin privileges through another means. Disabling or restricting SMI-invoking pathways at the OS level is generally not feasible without disrupting legitimate firmware functions. Secure Boot does not mitigate this vulnerability, as SMM operates below the Secure Boot enforcement boundary.
More in Yoga Pro 7 15Iph11 Bios
View allOut-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local privilege
Lenovo BIOS firmware across dozens of consumer and gaming laptop models - Legion, IdeaPad, Yoga, ThinkBook, LOQ, and V-s
SMM memory address disclosure in Lenovo laptop BIOS firmware exposes the location of protected System Management Mode (S
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today