// CVE · Published · Lenovo
Missing authentication allows WMI commands to trigger SMI handlers arbitrarily, reaching SMM (ring -2) code paths.
The SMI handler behind the BIOS setup WMI interface performed no authentication of its caller. Any ring-0 code could issue WMI commands that trigger the handler at will, which turns the buffer-validation bugs in the same module from a theoretical problem into a reachable one.
The CVE record reads: “A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System Management Interrupt handler.” Lenovo scores it 4.4 with CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N (CWE-306).
The four Lenovo CVEs describe one handler. CVE-2026-10588 leaks a live SMRAM address through an EFI variable, CVE-2026-10587 and CVE-2026-10589 are the missing buffer validation in the same handler, and CVE-2026-10590 is the missing authentication that lets any ring-0 caller drive it through WMI. Together they take a local administrator from ring 0 to code execution in System Management Mode, below the operating system and below Secure Boot.
The full analysis is in Inside the Lenovo SMM escalation chain, and the disclosure process in Coordinated disclosure with Lenovo PSIRT.
Each CVE record carries the same acknowledgement: “Lenovo thanks 0xiviel/Eva Crystal (XSource Security) for reporting this vulnerability.”
Out-of-bounds write in System Management Mode enabling code execution at SMM (ring -2) by a local privileged attacker.
Out-of-bounds write in System Management Mode lets a local privileged attacker modify power-management settings. Ring -2, below Secure Boot.
Discloses the address of protected SMM memory to a local privileged attacker, weakening SMRAM protections. Ring -2.
