// CVE · Published · Lenovo
Out-of-bounds write in System Management Mode enabling code execution at SMM (ring -2) by a local privileged attacker.
The WmiBiosSetupSmm module in Lenovo BIOS registers a software SMI handler on 0xDE. The handler used the size field of the communication buffer without validating it, so a local administrator could steer an out-of-bounds write from ring 0 into System Management Mode.
Code execution in SMM, the most privileged mode on the platform. The CVE record reads: “A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode.” Lenovo scores it 6.0 with CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H (CWE-787).
The four Lenovo CVEs describe one handler. CVE-2026-10588 leaks a live SMRAM address through an EFI variable, CVE-2026-10587 and CVE-2026-10589 are the missing buffer validation in the same handler, and CVE-2026-10590 is the missing authentication that lets any ring-0 caller drive it through WMI. Together they take a local administrator from ring 0 to code execution in System Management Mode, below the operating system and below Secure Boot.
The full analysis is in Inside the Lenovo SMM escalation chain, and the disclosure process in Coordinated disclosure with Lenovo PSIRT.
Each CVE record carries the same acknowledgement: “Lenovo thanks 0xiviel/Eva Crystal (XSource Security) for reporting this vulnerability.”
Out-of-bounds write in System Management Mode lets a local privileged attacker modify power-management settings. Ring -2, below Secure Boot.
Discloses the address of protected SMM memory to a local privileged attacker, weakening SMRAM protections. Ring -2.
Missing authentication allows WMI commands to trigger SMI handlers arbitrarily, reaching SMM (ring -2) code paths.
