// CVE · Published · Lenovo
Out-of-bounds write in System Management Mode lets a local privileged attacker modify power-management settings. Ring -2, below Secure Boot.
The same WmiBiosSetupSmm handler trusted a caller-supplied buffer without the SmmIsBufferOutsideSmmValid() check a firmware handler owes its callers. A pointer that overlaps SMRAM was accepted, and the write that services the request landed inside protected memory.
The CVE record reads: “A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode.” Lenovo scores it 6.0 with CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H (CWE-787).
The four Lenovo CVEs describe one handler. CVE-2026-10588 leaks a live SMRAM address through an EFI variable, CVE-2026-10587 and CVE-2026-10589 are the missing buffer validation in the same handler, and CVE-2026-10590 is the missing authentication that lets any ring-0 caller drive it through WMI. Together they take a local administrator from ring 0 to code execution in System Management Mode, below the operating system and below Secure Boot.
The full analysis is in Inside the Lenovo SMM escalation chain, and the disclosure process in Coordinated disclosure with Lenovo PSIRT.
Each CVE record carries the same acknowledgement: “Lenovo thanks 0xiviel/Eva Crystal (XSource Security) for reporting this vulnerability.”
Out-of-bounds write in System Management Mode enabling code execution at SMM (ring -2) by a local privileged attacker.
Discloses the address of protected SMM memory to a local privileged attacker, weakening SMRAM protections. Ring -2.
Missing authentication allows WMI commands to trigger SMI handlers arbitrarily, reaching SMM (ring -2) code paths.
