A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory.

published 2026-07-16 3 mo ago modified 2026-07-16 3 mo ago also EUVD-2026-44980

cvss: 4.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 4%
public exploits: 0; none known

Patch / fix

fixed in 22

Lenovo Yoga Pro 7 15IPH11 BIOS TNCN37WW
Lenovo IdeaPad Pro 5 16IPH11 BIOS S4CN62WW
Lenovo LOQ 15ARP10E BIOS SUCN18WW
Lenovo Legion Pro 7 16AFR10H BIOS SMCN20WW
Lenovo Legion Pro 7 16ADR10H BIOS SJCN17WW
Lenovo Lenovo V15 G4 AMN BIOS L1CN72WW
Lenovo ThinkBook 16p G6 ADR BIOS R7CN26WW
Lenovo Legion 5 15AHP10 BIOS RGCN35WW
Lenovo IdeaPad Slim 3 16IRU9 BIOS P2CN27WW
Lenovo Legion Pro 5 16IRX9 BIOS N0CN35WW
Lenovo Lenovo V15 G4 IAH BIOS MCCN39WW
Lenovo Lenovo V15 G5 IRL BIOS PMCN38WW
Lenovo IdeaPad Slim 3 16IRH8 BIOS LTCN44WW
Lenovo IdeaPad Slim 3 15AMN8 BIOS L1CN51WW
Lenovo Yoga 9 14IRP8 BIOS L4CN31WW
Lenovo IdeaPad 5 15ABA7 BIOS KACN29WW
Lenovo ThinkBook 16p G5 IRX BIOS P5CN31WW
Lenovo Lenovo V15 G2 IJL Laptop BIOS HTCN49WW
Lenovo ThinkBook 16p G6 IAX BIOS R2CN57WW
Lenovo Lenovo V14 G6 ITN BIOS RHCN20WW
Lenovo IdeaPad Slim 3 14ITN9 BIOS QUCN20WW
Lenovo IdeaPad Slim 3 16ARP10 BIOS QBCN30WW

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 mo ago (2026-07-16)

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.7	CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	3.1	4.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CNA	4.0	6.7	CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Lenovo Yoga Pro 7 15IPH11 BIOS
Lenovo IdeaPad Pro 5 16IPH11 BIOS
Lenovo Legion 7 16AGP11 BIOS
Lenovo IdeaPad Pro 5 16AGP11 BIOS
Lenovo Legion Pro 5 16ADR10 BIOS
Lenovo Lenovo V15 G6 ARP BIOS
Lenovo LOQ 15ARP10E BIOS
Lenovo Yoga Book 9 14IAH10 BIOS
Lenovo Legion Pro 7 16AFR10H BIOS
Lenovo Legion Pro 5 16AFR10 BIOS
Lenovo Legion Pro 7 16ADR10H BIOS
Lenovo Lenovo V15 G4 AMN BIOS
Lenovo ThinkBook Plus G6 Rollable BIOS
Lenovo Legion 5 15IAX10 BIOS
Lenovo Legion 5 15AKP10 BIOS
Lenovo Legion 5 15IRX10 BIOS
Lenovo Legion Pro 5 16IRX10 BIOS
Lenovo ThinkBook 16p G6 ADR BIOS
Lenovo Legion 5 15AHP10 BIOS
Lenovo Legion Pro 7 16IRX9H BIOS
Lenovo Legion 9 16IRX9 BIOS
Lenovo IdeaPad Slim 3 16IRU9 BIOS
Lenovo Legion Pro 5 16IRX9 BIOS
Lenovo IdeaPad Pro 5 16IMH9 BIOS
Lenovo Legion Pro 7 16ARX8H BIOS
Lenovo ThinkBook Plus G4 IRU BIOS
Lenovo Legion Slim 5 14APH8 BIOS
Lenovo ThinkBook Plus G5 Tab&ThinkBook Plus G5 Station BIOS
Lenovo Lenovo V15 G4 IAH BIOS
Lenovo Lenovo V15 G5 IRL BIOS
Lenovo Yoga Pro 9 14IRP8 BIOS
Lenovo IdeaPad Slim 3 16IRH8 BIOS
Lenovo IdeaPad Pro 5 16IRH8 BIOS
Lenovo IdeaPad Slim 3 15AMN8 BIOS
Lenovo Yoga 9 14IRP8 BIOS
Lenovo Legion Pro 5 16ARX8 BIOS
Lenovo Lenovo S14 G3 IAP BIOS
Lenovo IdeaPad 5 15ABA7 BIOS
Lenovo ThinkBook 16p G5 IRX BIOS
Lenovo Lenovo V15 G2 IJL Laptop BIOS
Lenovo Yoga Pro 9 16IMH9 BIOS
Lenovo ThinkBook 16p G6 IAX BIOS
Lenovo Legion 7 16IAX10 BIOS
Lenovo Legion Pro 5 16IAX10 BIOS
Lenovo Legion Pro 7 16IAX10H BIOS
Lenovo IdeaPad Slim 3 16IRH10R BIOS
Lenovo Legion 5 15IRX9 BIOS
Lenovo Lenovo V14 G6 ITN BIOS
Lenovo IdeaPad Slim 3 14ITN9 BIOS
Lenovo IdeaPad Slim 3 16ARP10 BIOS

Classification

Weakness

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

References

support.lenovo.com /us/en/product_security/LEN-220440
vendor-advisory

Sources

CVE List CVE-2026-10588
NVD CVE-2026-10588

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary