// research write-ups
Write-ups of published research: the finding, the root cause, the evidence and the disclosure. Deep dives with reproducible detail, nothing reposted.
Part 1 of 4. The Lenovo WmiBiosSetupSmm disclosure (CVE-2026-10587 to -10590), coordinated with Lenovo PSIRT under case LEN-213632 and published in advisory LEN-220440 on 14 July 2026. Most vulnerability write-ups live in the operating system, the…
Read write-up →Part 4 of 4: the Lenovo WmiBiosSetupSmm disclosure. See Part 1 (the chain), Part 2 (validation), and Part 3 (authorization). The first three parts covered the bugs. This one covers the process, because a firmware finding is only as good…
Read write-up →
