CVE-2026-10587 json
A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Managem…
published 2026-07-16 3 mo ago modified 2026-07-16 3 mo ago also EUVD-2026-44979
- cvss
- 6.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 3%
- public exploits
- 0
- none known
Summary
A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode.
Patch / fix
- Lenovo Yoga Pro 7 15IPH11 BIOS TNCN37WW
- Lenovo IdeaPad Pro 5 16IPH11 BIOS S4CN62WW
- Lenovo LOQ 15ARP10E BIOS SUCN18WW
- Lenovo Legion Pro 7 16AFR10H BIOS SMCN20WW
- Lenovo Legion Pro 7 16ADR10H BIOS SJCN17WW
- Lenovo Lenovo V15 G4 AMN BIOS L1CN72WW
- Lenovo ThinkBook 16p G6 ADR BIOS R7CN26WW
- Lenovo Legion 5 15AHP10 BIOS RGCN35WW
- Lenovo IdeaPad Slim 3 16IRU9 BIOS P2CN27WW
- Lenovo Legion Pro 5 16IRX9 BIOS N0CN35WW
- Lenovo Lenovo V15 G4 IAH BIOS MCCN39WW
- Lenovo Lenovo V15 G5 IRL BIOS PMCN38WW
- Lenovo IdeaPad Slim 3 16IRH8 BIOS LTCN44WW
- Lenovo IdeaPad Slim 3 15AMN8 BIOS L1CN51WW
- Lenovo Yoga 9 14IRP8 BIOS L4CN31WW
- Lenovo IdeaPad 5 15ABA7 BIOS KACN29WW
- Lenovo ThinkBook 16p G5 IRX BIOS P5CN31WW
- Lenovo Lenovo V15 G2 IJL Laptop BIOS HTCN49WW
- Lenovo ThinkBook 16p G6 IAX BIOS R2CN57WW
- Lenovo Lenovo V14 G6 ITN BIOS RHCN20WW
- Lenovo IdeaPad Slim 3 14ITN9 BIOS QUCN20WW
- Lenovo IdeaPad Slim 3 16ARP10 BIOS QBCN30WW
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.15% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.0 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
| CNA | 4.0 | 6.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Lenovo Yoga Pro 7 15IPH11 BIOS
- Lenovo IdeaPad Pro 5 16IPH11 BIOS
- Lenovo Legion 7 16AGP11 BIOS
- Lenovo IdeaPad Pro 5 16AGP11 BIOS
- Lenovo Legion Pro 5 16ADR10 BIOS
- Lenovo Lenovo V15 G6 ARP BIOS
- Lenovo LOQ 15ARP10E BIOS
- Lenovo Yoga Book 9 14IAH10 BIOS
- Lenovo Legion Pro 7 16AFR10H BIOS
- Lenovo Legion Pro 5 16AFR10 BIOS
- Lenovo Legion Pro 7 16ADR10H BIOS
- Lenovo Lenovo V15 G4 AMN BIOS
- Lenovo ThinkBook Plus G6 Rollable BIOS
- Lenovo Legion 5 15IAX10 BIOS
- Lenovo Legion 5 15AKP10 BIOS
- Lenovo Legion 5 15IRX10 BIOS
- Lenovo Legion Pro 5 16IRX10 BIOS
- Lenovo ThinkBook 16p G6 ADR BIOS
- Lenovo Legion 5 15AHP10 BIOS
- Lenovo Legion Pro 7 16IRX9H BIOS
- Lenovo Legion 9 16IRX9 BIOS
- Lenovo IdeaPad Slim 3 16IRU9 BIOS
- Lenovo Legion Pro 5 16IRX9 BIOS
- Lenovo IdeaPad Pro 5 16IMH9 BIOS
- Lenovo Legion Pro 7 16ARX8H BIOS
- Lenovo ThinkBook Plus G4 IRU BIOS
- Lenovo Legion Slim 5 14APH8 BIOS
- Lenovo ThinkBook Plus G5 Tab&ThinkBook Plus G5 Station BIOS
- Lenovo Lenovo V15 G4 IAH BIOS
- Lenovo Lenovo V15 G5 IRL BIOS
- Lenovo Yoga Pro 9 14IRP8 BIOS
- Lenovo IdeaPad Slim 3 16IRH8 BIOS
- Lenovo IdeaPad Pro 5 16IRH8 BIOS
- Lenovo IdeaPad Slim 3 15AMN8 BIOS
- Lenovo Yoga 9 14IRP8 BIOS
- Lenovo Legion Pro 5 16ARX8 BIOS
- Lenovo Lenovo S14 G3 IAP BIOS
- Lenovo IdeaPad 5 15ABA7 BIOS
- Lenovo ThinkBook 16p G5 IRX BIOS
- Lenovo Lenovo V15 G2 IJL Laptop BIOS
- Lenovo Yoga Pro 9 16IMH9 BIOS
- Lenovo ThinkBook 16p G6 IAX BIOS
- Lenovo Legion 7 16IAX10 BIOS
- Lenovo Legion Pro 5 16IAX10 BIOS
- Lenovo Legion Pro 7 16IAX10H BIOS
- Lenovo IdeaPad Slim 3 16IRH10R BIOS
- Lenovo Legion 5 15IRX9 BIOS
- Lenovo Lenovo V14 G6 ITN BIOS
- Lenovo IdeaPad Slim 3 14ITN9 BIOS
- Lenovo IdeaPad Slim 3 16ARP10 BIOS
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
support.lenovo.com
/us/en/product_security/LEN-220440
vendor-advisory
Sources
- CVE List CVE-2026-10587
- NVD CVE-2026-10587
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.