CVE-2026-10588: CWE‑497: Exposure of Sensitive System Information in Lenovo Yoga Pro 7 15IPH11 BIOS

This vulnerability involves the exposure of the address of protected System Management Mode memory in the BIOS of Lenovo Yoga Pro 7 15IPH11. A local attacker with high privileges could potentially disclose this sensitive system information. The CVSS 4.0 base score is 6.7, reflecting medium severity with local attack vector, low attack complexity, no user interaction, and high impact on confidentiality. No known exploits are reported in the wild, and no remediation level or patch information is currently available.

The vulnerability allows disclosure of the address of protected SMM memory, which is sensitive system information. This could facilitate further attacks by revealing memory layout details to a local privileged attacker. There is no indication of direct code execution or denial of service from this vulnerability alone.

Patch status is not yet confirmed — check the Lenovo vendor advisory for current remediation guidance. Until an official fix is released, monitor Lenovo's security advisories for updates. No specific mitigations or workarounds are currently documented.