// CVE · Published · Lenovo
Discloses the address of protected SMM memory to a local privileged attacker, weakening SMRAM protections. Ring -2.
An EFI variable readable from the operating system contained a live SMRAM address. That single value defeats the address-space uncertainty an SMM attacker otherwise has to work around, and it is the first link in the chain: with the map in hand, the unvalidated buffer writes in CVE-2026-10587 and CVE-2026-10589 become precise.
The CVE record reads: “A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory.” Lenovo scores it 4.4 with CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (CWE-497).
The four Lenovo CVEs describe one handler. CVE-2026-10588 leaks a live SMRAM address through an EFI variable, CVE-2026-10587 and CVE-2026-10589 are the missing buffer validation in the same handler, and CVE-2026-10590 is the missing authentication that lets any ring-0 caller drive it through WMI. Together they take a local administrator from ring 0 to code execution in System Management Mode, below the operating system and below Secure Boot.
The full analysis is in Inside the Lenovo SMM escalation chain, and the disclosure process in Coordinated disclosure with Lenovo PSIRT.
Each CVE record carries the same acknowledgement: “Lenovo thanks 0xiviel/Eva Crystal (XSource Security) for reporting this vulnerability.”
Out-of-bounds write in System Management Mode enabling code execution at SMM (ring -2) by a local privileged attacker.
Out-of-bounds write in System Management Mode lets a local privileged attacker modify power-management settings. Ring -2, below Secure Boot.
Missing authentication allows WMI commands to trigger SMI handlers arbitrarily, reaching SMM (ring -2) code paths.
