Out-of-bounds write in Lenovo Yoga Pro 7 15IPH11 BIOS
Priority LOW 29CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00147 3rd percentileScored 2026-11-07
Fix Fixed Yoga Pro 7 15IPH11 BIOS (Lenovo): TNCN37WWIdeaPad Pro 5 16IPH11 BIOS (Lenovo): S4CN62WW+21 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | Yoga Pro 7 15IPH11 BIOS | before TNCN37WW | TNCN37WW | Patch available | CNA |
| Lenovo | IdeaPad Pro 5 16IPH11 BIOS | before S4CN62WW | S4CN62WW | Patch available | CNA |
| Lenovo | Legion 7 16AGP11 BIOS | up to TPCN27WW | — | No fix listed | CNA |
| Lenovo | IdeaPad Pro 5 16AGP11 BIOS | up to T8CN19WW | — | No fix listed | CNA |
| Lenovo | Legion Pro 5 16ADR10 BIOS | up to U5CN07WW | — | No fix listed | CNA |
| Lenovo | Lenovo V15 G6 ARP BIOS | up to TYCN15WW | — | No fix listed | CNA |
| Lenovo | LOQ 15ARP10E BIOS | before SUCN18WW | SUCN18WW | Patch available | CNA |
| Lenovo | Yoga Book 9 14IAH10 BIOS | up to QEME23WW | — | No fix listed | CNA |
| Lenovo | Legion Pro 7 16AFR10H BIOS | before SMCN20WW | SMCN20WW | Patch available | CNA |
| Lenovo | Legion Pro 5 16AFR10 BIOS | up to RECN14WW | — | No fix listed | CNA |
| Lenovo | Legion Pro 7 16ADR10H BIOS | before SJCN17WW | SJCN17WW | Patch available | CNA |
| Lenovo | Lenovo V15 G4 AMN BIOS | before L1CN72WW | L1CN72WW | Patch available | CNA |
| Lenovo | ThinkBook Plus G6 Rollable BIOS | up to QWCN34WW | — | No fix listed | CNA |
| Lenovo | Legion 5 15IAX10 BIOS | up to S2CN15WW | — | No fix listed | CNA |
| Lenovo | Legion 5 15AKP10 BIOS | up to RYCN22WW | — | No fix listed | CNA |
| Lenovo | Legion 5 15IRX10 BIOS | up to QNCN28WW | — | No fix listed | CNA |
| Lenovo | Legion Pro 5 16IRX10 BIOS | up to S9CN13WW | — | No fix listed | CNA |
| Lenovo | ThinkBook 16p G6 ADR BIOS | before R7CN26WW | R7CN26WW | Patch available | CNA |
| Lenovo | Legion Pro 5 16ADR10 BIOS | up to RLCN21WW | — | No fix listed | CNA |
| Lenovo | Legion 5 15AHP10 BIOS | before RGCN35WW | RGCN35WW | Patch available | CNA |
| Lenovo | Legion Pro 7 16IRX9H BIOS | up to N2CN26WW | — | No fix listed | CNA |
| Lenovo | Legion 9 16IRX9 BIOS | up to NXCN20WW | — | No fix listed | CNA |
| Lenovo | IdeaPad Slim 3 16IRU9 BIOS | before P2CN27WW | P2CN27WW | Patch available | CNA |
| Lenovo | Legion Pro 5 16IRX9 BIOS | before N0CN35WW | N0CN35WW | Patch available | CNA |
| Lenovo | IdeaPad Pro 5 16IMH9 BIOS | up to MECN68WW | — | No fix listed | CNA |
| Lenovo | Legion Pro 7 16ARX8H BIOS | up to LPCN45WW | — | No fix listed | CNA |
| Lenovo | ThinkBook Plus G4 IRU BIOS | up to LUCN47WW | — | No fix listed | CNA |
| Lenovo | Legion Slim 5 14APH8 BIOS | up to MACN33WW | — | No fix listed | CNA |
| Lenovo | ThinkBook Plus G5 Tab&ThinkBook Plus G5 Station BIOS | up to P8CN42WW | — | No fix listed | CNA |
| Lenovo | Legion Pro 7 16ARX8H BIOS | up to LPCN59WW | — | No fix listed | CNA |
| Lenovo | Lenovo V15 G4 IAH BIOS | before MCCN39WW | MCCN39WW | Patch available | CNA |
| Lenovo | Lenovo V15 G5 IRL BIOS | before PMCN38WW | PMCN38WW | Patch available | CNA |
| Lenovo | Yoga Pro 9 14IRP8 BIOS | up to MBCN33WW | — | No fix listed | CNA |
| Lenovo | IdeaPad Slim 3 16IRH8 BIOS | before LTCN44WW | LTCN44WW | Patch available | CNA |
| Lenovo | IdeaPad Pro 5 16IRH8 BIOS | up to KZCN46WW | — | No fix listed | CNA |
| Lenovo | IdeaPad Slim 3 15AMN8 BIOS | before L1CN51WW | L1CN51WW | Patch available | CNA |
| Lenovo | Yoga 9 14IRP8 BIOS | before L4CN31WW | L4CN31WW | Patch available | CNA |
| Lenovo | Legion Pro 5 16ARX8 BIOS | up to LPCN59WW | — | No fix listed | CNA |
| Lenovo | Lenovo S14 G3 IAP BIOS | up to JKCN49WW | — | No fix listed | CNA |
| Lenovo | IdeaPad 5 15ABA7 BIOS | before KACN29WW | KACN29WW | Patch available | CNA |
| Lenovo | ThinkBook 16p G5 IRX BIOS | before P5CN31WW | P5CN31WW | Patch available | CNA |
| Lenovo | Lenovo V15 G2 IJL Laptop BIOS | before HTCN49WW | HTCN49WW | Patch available | CNA |
| Lenovo | Yoga Pro 9 16IMH9 BIOS | up to NKCN30WW | — | No fix listed | CNA |
| Lenovo | ThinkBook 16p G6 IAX BIOS | before R2CN57WW | R2CN57WW | Patch available | CNA |
| Lenovo | Legion 7 16IAX10 BIOS | up to RXCN18WW | — | No fix listed | CNA |
| Lenovo | Legion Pro 5 16IAX10 BIOS | up to Q6CN26WW | — | No fix listed | CNA |
| Lenovo | Legion Pro 7 16IAX10H BIOS | up to Q7CN31WW | — | No fix listed | CNA |
| Lenovo | IdeaPad Slim 3 16IRH10R BIOS | up to QDCN23WW | — | No fix listed | CNA |
| Lenovo | Legion 5 15IRX9 BIOS | up to PTCN14WW | — | No fix listed | CNA |
| Lenovo | Lenovo V14 G6 ITN BIOS | before RHCN20WW | RHCN20WW | Patch available | CNA |
| Lenovo | Yoga Book 9 14IAH10 BIOS | up to QECN21WW | — | No fix listed | CNA |
| Lenovo | IdeaPad Slim 3 14ITN9 BIOS | before QUCN20WW | QUCN20WW | Patch available | CNA |
| Lenovo | IdeaPad Slim 3 16ARP10 BIOS | before QBCN30WW | QBCN30WW | Patch available | CNA |
| Lenovo | IdeaPad Pro 5 16ASP10 BIOS | up to R1CN24WW | — | No fix listed | CNA |
| Lenovo | Legion 5 15APH9 BIOS | before PJCN18WW | PJCN18WW | Patch available | CNA |
| Lenovo | Yoga 9 2-in-1 14ILL10 BIOS | up to Q9CN22WW | — | No fix listed | CNA |
| Lenovo | Yoga Book 9 13IMU9 BIOS | up to NVCN24WW | — | No fix listed | CNA |
| Lenovo | IdeaPad Pro 5 16IAH10 BIOS | up to PZCN27WW | — | No fix listed | CNA |
| Lenovo | LOQ 15IAX9E BIOS | up to Q8CN17WW | — | No fix listed | CNA |
| Lenovo | Yoga 9 2-in-1 14IMH9 BIOS | up to NNCN31WW | — | No fix listed | CNA |
- Yoga Pro 7 15IPH11 BIOS VendorLenovo Affected before TNCN37WW Fixed in TNCN37WW Patch available CNA
- IdeaPad Pro 5 16IPH11 BIOS VendorLenovo Affected before S4CN62WW Fixed in S4CN62WW Patch available CNA
- Legion 7 16AGP11 BIOS VendorLenovo Affected up to TPCN27WW Fixed in — No fix listed CNA
- IdeaPad Pro 5 16AGP11 BIOS VendorLenovo Affected up to T8CN19WW Fixed in — No fix listed CNA
- Legion Pro 5 16ADR10 BIOS VendorLenovo Affected up to U5CN07WW Fixed in — No fix listed CNA
- Lenovo V15 G6 ARP BIOS VendorLenovo Affected up to TYCN15WW Fixed in — No fix listed CNA
- LOQ 15ARP10E BIOS VendorLenovo Affected before SUCN18WW Fixed in SUCN18WW Patch available CNA
- Yoga Book 9 14IAH10 BIOS VendorLenovo Affected up to QEME23WW Fixed in — No fix listed CNA
- Legion Pro 7 16AFR10H BIOS VendorLenovo Affected before SMCN20WW Fixed in SMCN20WW Patch available CNA
- Legion Pro 5 16AFR10 BIOS VendorLenovo Affected up to RECN14WW Fixed in — No fix listed CNA
- Legion Pro 7 16ADR10H BIOS VendorLenovo Affected before SJCN17WW Fixed in SJCN17WW Patch available CNA
- Lenovo V15 G4 AMN BIOS VendorLenovo Affected before L1CN72WW Fixed in L1CN72WW Patch available CNA
- ThinkBook Plus G6 Rollable BIOS VendorLenovo Affected up to QWCN34WW Fixed in — No fix listed CNA
- Legion 5 15IAX10 BIOS VendorLenovo Affected up to S2CN15WW Fixed in — No fix listed CNA
- Legion 5 15AKP10 BIOS VendorLenovo Affected up to RYCN22WW Fixed in — No fix listed CNA
- Legion 5 15IRX10 BIOS VendorLenovo Affected up to QNCN28WW Fixed in — No fix listed CNA
- Legion Pro 5 16IRX10 BIOS VendorLenovo Affected up to S9CN13WW Fixed in — No fix listed CNA
- ThinkBook 16p G6 ADR BIOS VendorLenovo Affected before R7CN26WW Fixed in R7CN26WW Patch available CNA
- Legion Pro 5 16ADR10 BIOS VendorLenovo Affected up to RLCN21WW Fixed in — No fix listed CNA
- Legion 5 15AHP10 BIOS VendorLenovo Affected before RGCN35WW Fixed in RGCN35WW Patch available CNA
- Legion Pro 7 16IRX9H BIOS VendorLenovo Affected up to N2CN26WW Fixed in — No fix listed CNA
- Legion 9 16IRX9 BIOS VendorLenovo Affected up to NXCN20WW Fixed in — No fix listed CNA
- IdeaPad Slim 3 16IRU9 BIOS VendorLenovo Affected before P2CN27WW Fixed in P2CN27WW Patch available CNA
- Legion Pro 5 16IRX9 BIOS VendorLenovo Affected before N0CN35WW Fixed in N0CN35WW Patch available CNA
- IdeaPad Pro 5 16IMH9 BIOS VendorLenovo Affected up to MECN68WW Fixed in — No fix listed CNA
- Legion Pro 7 16ARX8H BIOS VendorLenovo Affected up to LPCN45WW Fixed in — No fix listed CNA
- ThinkBook Plus G4 IRU BIOS VendorLenovo Affected up to LUCN47WW Fixed in — No fix listed CNA
- Legion Slim 5 14APH8 BIOS VendorLenovo Affected up to MACN33WW Fixed in — No fix listed CNA
- ThinkBook Plus G5 Tab&ThinkBook Plus G5 Station BIOS VendorLenovo Affected up to P8CN42WW Fixed in — No fix listed CNA
- Legion Pro 7 16ARX8H BIOS VendorLenovo Affected up to LPCN59WW Fixed in — No fix listed CNA
- Lenovo V15 G4 IAH BIOS VendorLenovo Affected before MCCN39WW Fixed in MCCN39WW Patch available CNA
- Lenovo V15 G5 IRL BIOS VendorLenovo Affected before PMCN38WW Fixed in PMCN38WW Patch available CNA
- Yoga Pro 9 14IRP8 BIOS VendorLenovo Affected up to MBCN33WW Fixed in — No fix listed CNA
- IdeaPad Slim 3 16IRH8 BIOS VendorLenovo Affected before LTCN44WW Fixed in LTCN44WW Patch available CNA
- IdeaPad Pro 5 16IRH8 BIOS VendorLenovo Affected up to KZCN46WW Fixed in — No fix listed CNA
- IdeaPad Slim 3 15AMN8 BIOS VendorLenovo Affected before L1CN51WW Fixed in L1CN51WW Patch available CNA
- Yoga 9 14IRP8 BIOS VendorLenovo Affected before L4CN31WW Fixed in L4CN31WW Patch available CNA
- Legion Pro 5 16ARX8 BIOS VendorLenovo Affected up to LPCN59WW Fixed in — No fix listed CNA
- Lenovo S14 G3 IAP BIOS VendorLenovo Affected up to JKCN49WW Fixed in — No fix listed CNA
- IdeaPad 5 15ABA7 BIOS VendorLenovo Affected before KACN29WW Fixed in KACN29WW Patch available CNA
- ThinkBook 16p G5 IRX BIOS VendorLenovo Affected before P5CN31WW Fixed in P5CN31WW Patch available CNA
- Lenovo V15 G2 IJL Laptop BIOS VendorLenovo Affected before HTCN49WW Fixed in HTCN49WW Patch available CNA
- Yoga Pro 9 16IMH9 BIOS VendorLenovo Affected up to NKCN30WW Fixed in — No fix listed CNA
- ThinkBook 16p G6 IAX BIOS VendorLenovo Affected before R2CN57WW Fixed in R2CN57WW Patch available CNA
- Legion 7 16IAX10 BIOS VendorLenovo Affected up to RXCN18WW Fixed in — No fix listed CNA
- Legion Pro 5 16IAX10 BIOS VendorLenovo Affected up to Q6CN26WW Fixed in — No fix listed CNA
- Legion Pro 7 16IAX10H BIOS VendorLenovo Affected up to Q7CN31WW Fixed in — No fix listed CNA
- IdeaPad Slim 3 16IRH10R BIOS VendorLenovo Affected up to QDCN23WW Fixed in — No fix listed CNA
- Legion 5 15IRX9 BIOS VendorLenovo Affected up to PTCN14WW Fixed in — No fix listed CNA
- Lenovo V14 G6 ITN BIOS VendorLenovo Affected before RHCN20WW Fixed in RHCN20WW Patch available CNA
- Yoga Book 9 14IAH10 BIOS VendorLenovo Affected up to QECN21WW Fixed in — No fix listed CNA
- IdeaPad Slim 3 14ITN9 BIOS VendorLenovo Affected before QUCN20WW Fixed in QUCN20WW Patch available CNA
- IdeaPad Slim 3 16ARP10 BIOS VendorLenovo Affected before QBCN30WW Fixed in QBCN30WW Patch available CNA
- IdeaPad Pro 5 16ASP10 BIOS VendorLenovo Affected up to R1CN24WW Fixed in — No fix listed CNA
- Legion 5 15APH9 BIOS VendorLenovo Affected before PJCN18WW Fixed in PJCN18WW Patch available CNA
- Yoga 9 2-in-1 14ILL10 BIOS VendorLenovo Affected up to Q9CN22WW Fixed in — No fix listed CNA
- Yoga Book 9 13IMU9 BIOS VendorLenovo Affected up to NVCN24WW Fixed in — No fix listed CNA
- IdeaPad Pro 5 16IAH10 BIOS VendorLenovo Affected up to PZCN27WW Fixed in — No fix listed CNA
- LOQ 15IAX9E BIOS VendorLenovo Affected up to Q8CN17WW Fixed in — No fix listed CNA
- Yoga 9 2-in-1 14IMH9 BIOS VendorLenovo Affected up to NNCN31WW Fixed in — No fix listed CNA
Remediation
- Fix · CNA Yoga Pro 7 15IPH11 BIOS (Lenovo) Fixed in TNCN37WW
- Fix · CNA IdeaPad Pro 5 16IPH11 BIOS (Lenovo) Fixed in S4CN62WW
- Fix · CNA LOQ 15ARP10E BIOS (Lenovo) Fixed in SUCN18WW
- Fix · CNA Legion Pro 7 16AFR10H BIOS (Lenovo) Fixed in SMCN20WW
- Fix · CNA Legion Pro 7 16ADR10H BIOS (Lenovo) Fixed in SJCN17WW
- Fix · CNA Lenovo V15 G4 AMN BIOS (Lenovo) Fixed in L1CN72WW
- Fix · CNA ThinkBook 16p G6 ADR BIOS (Lenovo) Fixed in R7CN26WW
- Fix · CNA Legion 5 15AHP10 BIOS (Lenovo) Fixed in RGCN35WW
- Fix · CNA IdeaPad Slim 3 16IRU9 BIOS (Lenovo) Fixed in P2CN27WW
- Fix · CNA Legion Pro 5 16IRX9 BIOS (Lenovo) Fixed in N0CN35WW
- Fix · CNA Lenovo V15 G4 IAH BIOS (Lenovo) Fixed in MCCN39WW
- Fix · CNA Lenovo V15 G5 IRL BIOS (Lenovo) Fixed in PMCN38WW
- Fix · CNA IdeaPad Slim 3 16IRH8 BIOS (Lenovo) Fixed in LTCN44WW
- Fix · CNA IdeaPad Slim 3 15AMN8 BIOS (Lenovo) Fixed in L1CN51WW
- Fix · CNA Yoga 9 14IRP8 BIOS (Lenovo) Fixed in L4CN31WW
- Fix · CNA IdeaPad 5 15ABA7 BIOS (Lenovo) Fixed in KACN29WW
- Fix · CNA ThinkBook 16p G5 IRX BIOS (Lenovo) Fixed in P5CN31WW
- Fix · CNA Lenovo V15 G2 IJL Laptop BIOS (Lenovo) Fixed in HTCN49WW
- Fix · CNA ThinkBook 16p G6 IAX BIOS (Lenovo) Fixed in R2CN57WW
- Fix · CNA Lenovo V14 G6 ITN BIOS (Lenovo) Fixed in RHCN20WW
- Fix · CNA IdeaPad Slim 3 14ITN9 BIOS (Lenovo) Fixed in QUCN20WW
- Fix · CNA IdeaPad Slim 3 16ARP10 BIOS (Lenovo) Fixed in QBCN30WW
- Fix · CNA Legion 5 15APH9 BIOS (Lenovo) Fixed in PJCN18WW
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Lenovo IdeaPad 5 15ABA7 BIOS, IdeaPad Pro 5 16AGP11 BIOS and 55 more products — support.lenovo.com/us/en/product_security/LEN-220440
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2026-09108 A potential missing authentication vulnerability could allow a local privileged attacker…Priority LOW 29
- TI-2026-09107 Out-of-bounds write in Lenovo Yoga Pro 7 15IPH11 BIOSPriority LOW 29
- TI-2026-09106 A potential vulnerability could allow a local privileged attacker to disclose the address…Priority LOW 29
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10587
- 2026-10-03 Alias added: GHSA-rmm6-xmjx-84r5
References
More Lenovo vulnerabilities
- TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2024-07516 Insecure Platform Key (PK) used in UEFI system firmware signature CVSS 3.1MEDIUM 6.4
- TI-2017-13070 OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory… CVSS 3.0CRITICAL 9.8
- TI-2017-02875 OS command injection in Lenovo Service Framework application CVSS 3.0CRITICAL 9.8
- TI-2013-01192 Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate… CVSS 2.0HIGH 9.3
- TI-2026-53163 Hard-coded credentials in Lenovo Health Application CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-10587 · CVE Program
- CVE-2026-10587 · NVD
- FIRST EPSS
- GHSA-rmm6-xmjx-84r5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences