// research write-ups
Write-ups of published research: the finding, the root cause, the evidence and the disclosure. Deep dives with reproducible detail, nothing reposted.
Part 1 of 4. The Lenovo WmiBiosSetupSmm disclosure (CVE-2026-10587 to -10590), coordinated with Lenovo PSIRT under case LEN-213632 and published in advisory LEN-220440 on 14 July 2026. Most vulnerability write-ups live in the operating system, the…
Read write-up →Part 2 of 4: the Lenovo WmiBiosSetupSmm disclosure. Start with Part 1 for the architecture and the escalation chain. Part 1 named the target: WmiBiosSetupSmm, software SMI 0xDE, on the Lenovo Legion 5 15IRX10 (BIOS QNCN33WW v1.33, InsydeH2O). This part opens the handler and…
Read write-up →Part 3 of 4: the Lenovo WmiBiosSetupSmm disclosure. See Part 1 (the chain) and Part 2 (the missing validation). Missing size and buffer checks make a handler fragile. Two more gaps make it usable: it authenticates nobody, and it hands the…
Read write-up →Part 4 of 4: the Lenovo WmiBiosSetupSmm disclosure. See Part 1 (the chain), Part 2 (validation), and Part 3 (authorization). The first three parts covered the bugs. This one covers the process, because a firmware finding is only as good…
Read write-up →
