# CVE-2026-10587: Lenovo BIOS out-of-bounds write in System Management Mode

Source: https://junglewise.ai/threats/cve-2026-10587-lenovo-bios-out-of-bounds-write-in-system-management-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-10587 · Severity: medium · CVSS 6 · Published 2026-07-16

A vulnerability in the BIOS firmware of several Lenovo laptop models could allow an attacker with administrative access to the computer to modify highly sensitive power management settings. These settings are handled in a protected area of the system called System Management Mode (SMM). If exploited, this could lead to system instability or a denial of service by tampering with how the hardware manages power and performance.

Technologies: [Lenovo IdeaPad Pro 5 16AGP11 BIOS](https://junglewise.ai/threats/technologies/ideapad-pro-5-16agp11-bios), [Lenovo IdeaPad Pro 5 16IPH11 BIOS](https://junglewise.ai/threats/technologies/ideapad-pro-5-16iph11-bios), [Lenovo Legion 7 16AGP11 BIOS](https://junglewise.ai/threats/technologies/legion-7-16agp11-bios), [Lenovo Legion Pro 5 16ADR10 BIOS](https://junglewise.ai/threats/technologies/legion-pro-5-16adr10-bios), [Lenovo Legion Pro 5 16AFR10 BIOS](https://junglewise.ai/threats/technologies/legion-pro-5-16afr10-bios), [Lenovo Legion Pro 7 16ADR10H BIOS](https://junglewise.ai/threats/technologies/legion-pro-7-16adr10h-bios), [Lenovo Legion Pro 7 16AFR10H BIOS](https://junglewise.ai/threats/technologies/legion-pro-7-16afr10h-bios), [Lenovo LOQ 15ARP10E BIOS](https://junglewise.ai/threats/technologies/loq-15arp10e-bios), [Lenovo V15 G6 ARP BIOS](https://junglewise.ai/threats/technologies/v15-g6-arp-bios), [Lenovo Yoga Book 9 14IAH10 BIOS](https://junglewise.ai/threats/technologies/yoga-book-9-14iah10-bios), [Lenovo Yoga Pro 7 15IPH11 BIOS](https://junglewise.ai/threats/technologies/yoga-pro-7-15iph11-bios). Vendors: [Lenovo](https://junglewise.ai/threats/vendors/lenovo).

## Quick answers

**Is CVE-2026-10587 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10587 being exploited in the wild.

**How severe is CVE-2026-10587?** Medium severity, with a CVSS score of 6, published 16 July 2026.

**Which products and versions are affected?** Lenovo IdeaPad Pro 5 16AGP11 BIOS up to and including T8CN19WW; Lenovo IdeaPad Pro 5 16IPH11 BIOS before S4CN62WW; Lenovo Legion 7 16AGP11 BIOS up to and including TPCN27WW; Lenovo Legion Pro 5 16ADR10 BIOS up to and including U5CN07WW; and 7 more.

**Is there a fix for CVE-2026-10587?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10587 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-10587?** Check whether you run Lenovo IdeaPad Pro 5 16AGP11 BIOS, Lenovo IdeaPad Pro 5 16IPH11 BIOS, Lenovo Legion 7 16AGP11 BIOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability exists within the System Management Mode (SMM) of various Lenovo BIOS versions. A local attacker with high privileges (administrative or SYSTEM) can trigger this flaw to write data outside of intended memory boundaries. This specific vulnerability targets power management configurations handled by SMM. Successful exploitation allows the attacker to modify these settings, potentially leading to a denial of service or unauthorized modification of firmware-level parameters. Fixes are available via BIOS updates for the affected models.

## Affected products

- Lenovo Yoga Pro 7 15IPH11 BIOS before TNCN37WW
- Lenovo IdeaPad Pro 5 16IPH11 BIOS before S4CN62WW
- Lenovo Legion 7 16AGP11 BIOS up to and including TPCN27WW
- Lenovo IdeaPad Pro 5 16AGP11 BIOS up to and including T8CN19WW
- Lenovo Legion Pro 5 16ADR10 BIOS up to and including U5CN07WW
- Lenovo Lenovo V15 G6 ARP BIOS up to and including TYCN15WW
- Lenovo LOQ 15ARP10E BIOS before SUCN18WW
- Lenovo Yoga Book 9 14IAH10 BIOS up to and including QEME23WW
- Lenovo Legion Pro 7 16AFR10H BIOS before SMCN20WW
- Lenovo Legion Pro 5 16AFR10 BIOS up to and including RECN14WW
- Lenovo Legion Pro 7 16ADR10H BIOS before SJCN17WW

## Timeline

- 2026-07-16: disclosed
- 2026-07-16: advisory

## References

- [https://support.lenovo.com/us/en/product_security/LEN-220440](https://support.lenovo.com/us/en/product_security/LEN-220440)

## Related threats

- [Lenovo BIOS missing authentication in SMI handler via WMI](https://junglewise.ai/threats/cve-2026-10590-lenovo-bios-missing-authentication-in-smi-handler-via-wmi)
- [Lenovo BIOS out of bounds write in System Management Mode](https://junglewise.ai/threats/cve-2026-10589-lenovo-bios-out-of-bounds-write-in-system-management-mode)
- [Lenovo BIOS information disclosure in System Management Mode memory](https://junglewise.ai/threats/cve-2026-10588-lenovo-bios-information-disclosure-in-system-management-mode)