CVE-2026-10588

Executive Summary

CVE-2026-10588 is a high-severity vulnerability in Lenovo firmware/System Management Mode (SMM) components that allows a local privileged attacker to disclose the physical address of protected SMM memory regions. With a CVSS score of 6.7 (High), the flaw stems from improper access control (CWE-284) and enables information disclosure of the SMM address space — a critical first step in SMM-based privilege escalation chains. Organizations running Lenovo enterprise PCs, ThinkPad notebooks, ThinkCentre desktops, and ThinkStation workstations with vulnerable firmware versions should prioritize patching, as the vulnerability has a publicly available PoC and can be weaponized to defeat System Management Interrupt (SMI)-based security mechanisms.

Technical Analysis

CVE-2026-10588 is an information disclosure vulnerability rooted in inadequate access control (CWE-284) within Lenovo's SMM handlers. System Management Mode (SMM) is a privileged x86 execution mode used for platform management operations, including power management, thermal control, and firmware update handling. SMM executes in a protected memory region (SMRAM) that is inaccessible to the OS kernel and other ring-0 code unless specifically permitted.

The vulnerability mechanism involves an SMI (System Management Interrupt) handler in Lenovo firmware that lacks proper validation of caller-supplied parameters. A local privileged attacker — one with ring-0 or SMM-callable privileges — can invoke this SMI handler via the out instruction sequence that triggers SMI. The handler fails to sanitize a buffer pointer argument, allowing the attacker to request that the firmware disclose the logical address of a SMM memory-mapped region.

Specifically, the affected SMI handler exposes a function that returns the base address of SMM-protected memory. Under normal operation, such addresses should be withheld from untrusted callers because knowing the SMRAM base address enables the attacker to calculate offsets into SMM code and data structures. The flawed access control check does not verify that the calling context is a trusted SMM module rather than arbitrary ring-0 code.

The attack surface is the SMI handler dispatch table. Lenovo firmware implements standardized SMM communication via the EFI_SMM_COMMUNICATION_PROTOCOL. The vulnerable handler processes requests from the OS-side SMM communication buffer. Because the handler does not enforce caller identity checks, any code running at ring-0 (e.g., a kernel driver or a vulnerable device driver) can submit a crafted request.

Code-Level Explanation

The vulnerability class resembles an SMM communication buffer race condition or a TOCTOU (time-of-check to time-of-use) flaw in the handler's parameter validation. The handler likely performs the following:

1. Receives CommBuffer pointer containing SMM_COMMUNICATE_HEADER and payload.
2. Extracts a GUID-tagged function ID.
3. For the vulnerable function, reads an offset field from the payload without validating its range.
4. Returns a pointer to SMM memory based on that offset.

The access control failure occurs at step 3: the offset is trusted without checking whether the requester is permitted to query SMM memory mappings. This is a classic CWE-284 (Improper Access Control) — the handler implements a permission check inconsistently or omits it entirely for this specific function.

Because the CVSS vector indicates PR:H (high privileges required), the attacker must already have administrative or kernel-level code execution. This is consistent with an attack where the attacker has loaded a kernel driver or gained ring-0 code execution and is now pivoting to escalate to SMM-level control.

Exploitation Scenarios

Scenario: Privilege Escalation from Kernel to SMM

1) Reconnaissance and Target Identification

The attacker identifies the Lenovo device model and firmware version. Using tools like dmidecode, wmic bios, or Lenovo's getbiosinfo utility, the attacker confirms the firmware version falls within the vulnerable range. The attacker also verifies they have ring-0 code execution (e.g., via a signed but vulnerable kernel driver already loaded, or through another CVE that provides root on the host OS).

2) Trigger / Weaponization

The attacker crafts a kernel-mode program that uses the __outbyte instruction (or inb/outb calls) with SW_SMI_PORT (typically 0xB2 on Intel platforms) to generate a System Management Interrupt. The SMI handler dispatches based on a command value in the AL register. The attacker selects the vendor-specific SMI command that maps to the vulnerable function (identified by reverse-engineering the SMI dispatch table from firmware images, or by using publicly available PoC code that already identifies the correct command value).

The payload structure:

SMM_COMMUNICATE_HEADER header;
header.HeaderGuid = vulnerable_handler_guid;
header.MessageLength = payload_size;
header.Data = payload;

The payload contains a function ID that triggers the address query, and an offset field. The attacker sets the offset to 0 to retrieve the SMRAM base address.

3) Execution

The attacker executes:

outb(SW_SMI_PORT, SMI_COMMAND_VALUE);

This raises an SMI synchronously. The CPU switches to SMM, the vulnerable handler processes the request, and writes the SMRAM base address to the communication buffer.

Alternatively, the attacker uses the EFI Runtime Services GetVariable or SetVariable calls if the vulnerable function is exposed via a variable-level interface — this depends on the specific Lenovo model.

4) Post-Exploitation Impact

With the SMRAM base address disclosed, the attacker can:

• Compute offsets to SMM code segments and SMM heap structures.
• Combine this with a separate SMM write primitive vulnerability (many of which have been disclosed for Lenovo/Dell/HP platforms — e.g., the SMM "write-what-where" family) to place shellcode in SMRAM.
• Achieve SMM code execution, which is invisible to the OS and survives OS reinstallation. This enables persistent firmware-level backdoors, disabling of Secure Boot, and credential theft via memory scraping.

The information disclosure alone does not give code execution; it is a chaining enabler. The attacker's next step would leverage the address to bypass SMM sandboxing or to disable SMM-based security protections (e.g., IME/PSP telemetry or memory encryption checks).

Public PoC Note: A public PoC exists (per CVE data), so security researchers and attackers have access to prebuilt exploit code that identifies the vulnerable SMI handler and triggers the disclosure.

Impact Assessment

The CVSS score of 6.7 with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N indicates:

• Attack Vector: Local (L) — the attacker must have local access to the target machine.
• Attack Complexity: Low (L) — the exploitation mechanics are well understood and a public PoC exists.
• Privileges Required: High (H) — ring-0 code execution is mandatory, meaning the attacker must already have root/admin or a kernel-level exploit.
• User Interaction: None (N) — no user action is required beyond the attacker's own actions.
• Scope: Unchanged (U) — the disclosure is contained within the same security boundary (SMM → kernel information disclosure does not cross to other components).
• Confidentiality Impact: High (H) — SMM memory addresses are secrets; their disclosure defeats a fundamental security boundary.
• Integrity Impact: None (N) in the direct attack; however, subsequent chaining could achieve integrity compromise.
• Availability Impact: None (N).

Business Impact

For enterprise environments:

• Affected Systems: Lenovo ThinkPad (T, X, P, L series), ThinkCentre, ThinkStation, and possibly IdeaPad/legion consumer devices with UEFI firmware released before the LEN-220440 advisory date. Also Lenovo-branded multi-function devices and servers that share the same firmware base (specifically those using the common Lenovo/AMI/Insyde firmware stack).
• Blast Radius: An attacker who exploits this on a single asset gains SMM address disclosure. If chained with an SMM write primitive, the attacker achieves persistent firmware backdooring — the machine must be physically replaced or the SPI flash chip reprogrammed externally to recover. Lateral movement is not directly facilitated, but the permanent persistence on a single asset can undermine the integrity of a whole domain if that asset is a domain controller or has access to other systems.
• EPSS Consideration: EPSS score of 0.00107 (1.4th percentile) indicates a low probability of exploitation in the next 30 days based on current threat intelligence. However, public PoC availability can rapidly change this. Organizations should not treat this as "low risk" solely due to EPSS — the technical severity (C:H) and chaining potential warrant immediate patching.

Detection Guidance

Sigma Rule

title: Lenovo SMM Address Disclosure via OutPort (CVE-2026-10588)
id: 42c3f8e6-97c5-4a2e-9d1b-7f6a3b8c4d2f
status: experimental
description: Detects execution of code that generates SW SMI via port 0xB2 with a command value matching CVE-2026-10588 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-10588
    - https://support.lenovo.com/us/en/product_security/LEN-220440
author: ValtersIT Threat Intelligence
date: 2026/04/25
logsource:
    category: process_creation
    product: windows
    definition: Requires Sysmon Event ID 1 or equivalent process creation logging with full command line.
detection:
    selection_ioctl:
        Image|endswith:
            - '\\exploit.exe'
            - '\\smm_dump.exe'
            - '\\cve-2026-10588.exe'
    selection_commandline:
        CommandLine|contains:
            - '0xB2'
            - 'outb'
            - 'SMI'
            - 'SMRAM'
    selection_priv:
        IntegrityLevel: 'System'
    condition: selection_ioctl or (selection_commandline and selection_priv)
falsepositives:
    - Legitimate firmware update tools that use SMI to invoke flash operations (e.g., Lenovo Vantage, BIOS update utilities).
level: high
tags:
    - attack.privilege_escalation
    - attack.t1211
    - cve.2026.10588
    - cwe.284

YARA Rule

rule CVE_2026_10588_Lenovo_SMM_Address_Disclosure
{
    meta:
        author = "ValtersIT Threat Intelligence"
        date = "2026-04-25"
        description = "Detects exploit binaries or shellcode that issue outb(0xB2) SMI calls targeting Lenovo vulnerable SMI handler"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-10588"
        cve = "CVE-2026-10588"
        severity = "high"

    strings:
        $smi_port = { B2 }
        $out_inst  = { EE }                // x86 OUT DX, AL
        $out_imm   = { E6 B2 }             // OUT imm8, AL with B2 I/O port
        $ioctl_code1 = "vulnerable_handler_guid"  // GUID string constant used in PoC
        $smm_com    = "SMM_COMMUNICATE_HEADER"
        $smram_ref  = "SMRAM"
        $lenovo_ref = "Lenovo"

    condition:
        uint16(0) == 0x5A4D and                          // MZ header
        filesize < 5MB and
        (
            ( #out_inst >= 3 or #out_imm >= 3 ) and
            ( #smi_port >= 4 or $ioctl_code1 or $smm_com or $smram_ref )
        ) and
        ( $lenovo_ref or $smram_ref )
}

Suricata IDS Rule

This is a local firmware-level vulnerability. No meaningful network-level exploit exists because the attack requires local ring-0 code and does not traverse the network. However, the exploitation payload could be delivered via a kernel driver over the network during a multi-stage attack. The rule below detects the delivery of known exploit binaries over HTTP/SMB.

alert http any any -> $HOME_NET any (msg:"CVE-2026-10588 Lenovo SMM Address Disclosure exploit binary delivery"; flow:established,to_client; filemagic:"PE executable"; fileext:"exe"; content:"Lenovo"; content:"SMRAM"; distance:0; within:4096; reference:cve,CVE-2026-10588; reference:url,support.lenovo.com/us/en/product_security/LEN-220440; classtype:attempted-user; sid:202610588001; rev:1;)

alert smb any any -> any any (msg:"CVE-2026-10588 exploit driver via SMB share"; flow:established,to_client; content:"|FF D8 FF E0 00 10 4A 46 49 46 00|"; within:4096; reference:cve,CVE-2026-10588; classtype:attempted-user; sid:202610588002; rev:1;)

Elastic Detection

// EQL detection for process execution of known CVE-2026-10588 exploit binaries.
// Place in Elastic Defend custom query or detection rules.

process where event.type == "start" and
  process.name in (
    "exploit.exe",
    "smm_dump.exe",
    "cve-2026-10588.exe",
    "smi_query.exe"
  ) and
  process.command_line like "*0xB2*" or
  process.command_line like ("*SMRAM*", "*SMI*", "*outb*")

// EQL for Sysmon Event ID 1 via Elastic Agent
sequence with maxspan=1m
  [process where event.code == "1" and
     process.command_line like "*0xB2*" and
     process.callchain_depth == 2]
  [file where event.code == "11" and
     file.name like "*.sys" and
     file.mode == "644" and
     file.path like "C:\\Windows\\System32\\drivers\\*"]

Splunk SPL Query

index=windows sourcetype=ProcessCreation
| search CommandLine="*0xB2*" OR CommandLine="*SMRAM*" OR CommandLine="*SMI*"
    OR Image IN ("*exploit.exe", "*smm_dump.exe", "*cve-2026-10588.exe")
| stats count by ComputerName, Image, CommandLine, IntegrityLevel, ParentImage
| where IntegrityLevel="System" OR count > 1
| sort - _time

index=windows EventCode=4688
| search New_Process_Name IN ("*exploit.exe", "*smm_dump.exe", "*cve-2026-10588.exe") 
    OR CommandLine="*outb*" OR CommandLine="*0xB2*"
| table _time, Computer, New_Process_Name, CommandLine, Subject_UserName
| convert ctime(_time)

Wazuh OSSEC Rule

<group name="CVE-2026-10588, Lenovo, SMM,">

    <!-- Detection: Windows process using SW_SMI port 0xB2 -->
    <rule id="424635" level="14">
        <if_sid>87101</if_sid>  <!-- Parent: sysmon process creation -->
        <match>0xB2</match>
        <regex>CommandLine.*(SMRAM|SMI|outb|0xB2)</regex>
        <description>CVE-2026-10588: Possible SMM address disclosure attempt on Lenovo platform</description>
        <group>local_policy,attack.privilege_escalation,</group>
        <mitre>
            <id>T1211</id>
            <tactic>Privilege Escalation</tactic>
        </mitre>
        <info>(CVE-2026-10588) Confirmed exploit binary attempting to invoke SW SMI with port 0xB2 on a Lenovo model</info>
        <options>no_full_log</options>
        <alert_level>14</alert_level>
    </rule>

    <!-- Detection: File creation in System32\drivers matching known exploit names -->
    <rule id="424636" level="12">
        <if_sid>554</if_sid>  <!-- syscheck new file -->
        <field name="file">\.sys$</field>
        <match>smm_dump|exploit|smi_query</match>
        <description>CVE-2026-10588: Kernel driver module matching known exploit pattern installed</description>
        <group>local_policy,attack.privilege_escalation,</group>
        <mitre>
            <id>T1211</id>
            <tactic>Privilege Escalation</tactic>
        </mitre>
        <options>no_full_log</options>
        <alert_level>12</alert_level>
    </rule>

</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source claims the patch; not independently confirmed)

1. Immediate Mitigations (while awaiting verified patch):

   • Enforce the principle of least privilege on all Lenovo endpoints. Since the vulnerability requires PR:H (ring-0 code execution), limiting which users/processes can load kernel drivers significantly raises the exploitation bar.
   • Enable Microsoft Device Guard / Hypervisor-Protected Code Integrity (HVCI) on Windows 10/11 Enterprise, which prevents unsigned and unapproved kernel drivers from loading. This blocks most practical exploitation chains for this CVE.
   • Apply Lenovo's recommended Secure Boot and Platform Trust Module (TPM) policy: ensure Secure Boot is enabled and keys are managed to prevent unauthorized SMM handler modifications.
   • Monitor SMI activity via vendor tools (Lenovo Vantage, Lenovo ThinkShield). Alert on OEM-specific SMI commands that are not routine firmware update operations.

2. Patch/Upgrade Steps:

   • Obtain the official advisory LEN-220440 from https://support.lenovo.com/us/en/product_security/LEN-220440.
   • The advisory lists per-model firmware versions with the fix. Update the BIOS/UEFI to that version or newer.
   • For fleet deployment: use Lenovo Update Retriever or the Lenovo Patch and Vulnerability Management (PVM) tool, available in Lenovo XClarity for data-center systems, to push firmware updates centrally.
   • After updating, verify firmware version in setup menu (F1 key during POST) or via wmic bios get smbiosbiosversion.
   • Note: The advisory is the single source claiming the patch. Independently verify the patched firmware — e.g., test with a public PoC binary against a test machine before claiming remediation. If the PoC still succeeds after update, the patch is incomplete; report to Lenovo and escalate.

3. Long-Term Hardening:

   • Establish an SMM-impact assessment for any firmware update from Lenovo — track the role of SMM handlers and whether additional SMM vulnerabilities (the "write-what-where" family) remain unpatched in the same firmware lineage.
   • Implement firmware attestation using BootGuard or the Intel Platform Firmware Resilience (PFR) program where hardware supports it.
   • Integrate CVE-2026-10588 into a threat model that considers SMM-level attacks. The exposure of SMRAM base addresses is a building block; monitor for chained exploits (SMM write primitives, SMM call-out vulnerabilities).
   • Disable unsupported features in firmware settings that may expose additional SMI interfaces (e.g., Intel AMT, Intel SCS if not required).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-10588 — Official NVD record with CVSS 6.7 and CWE-284.
2. Lenovo Security Advisory LEN-220440: https://support.lenovo.com/us/en/product_security/LEN-220440 — Vendor advisory containing per-model patched firmware versions and mitigation details.
3. CWE-284 Improper Access Control: https://cwe.mitre.org/data/definitions/284.html — Underlying weakness class reference.
4. MITRE ATT&CK T1211 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1211/ — ATT&CK technique mapping for local privilege escalation via vulnerability exploitation.
5. CISA KEV (Known Exploited Vulnerabilities): No entry for CVE-2026-10588 as of the report date. This CVE is NOT in the CISA KEV catalog — do not apply KEV-based prioritization; rely on patch advisory timing instead.

Threat Actor Campaign Evidence: As of the date of this report, there are no publicly attributed threat actor campaigns exploiting CVE-2026-10588 in the wild. The EPSS score of 0.00107 (1.4th percentile) corroborates that exploitation activity is minimal. However, the existence of a public PoC and the low EPSS-percentile discrepancy (public PoC usually raises EPSS) suggest either the PoC is technically immature or the required PR:H reduces attacker utility. Organizations should expect exploit attempts to increase if a chaining primitive (SMM write) is publicly disclosed. Monitor your EDR/XDR and firmware integrity logs for kernel driver installs that invoke SMI instructions.