A BIOS flaw allows an out‑of‑bounds write when power management settings are adjusted in System Management Mode. The vulnerable buffer overflow (CWE‑787) can be exploited by a user with local administrative privileges to overwrite adjacent memory and alter the integrity of BIOS power configuration. The flaw does not directly provide confidential data or remote code execution, but it compromises low‑level system settings and could serve as a foothold for further exploitation.

Affected devices comprise a broad range of Lenovo laptop models, including the IdeaPad 5, IdeaPad Pro 5, IdeaPad Slim 3, LOQ, as well as the Legion 5/7/9 series and Legion Pro models, ThinkBook 16p G5/G6, ThinkBook Plus G4/G5/G6, Yoga 9 2‑in‑1, Yoga Book 9, Yoga Pro 9, and various other Lenovo branded configurations. All units running BIOS firmware versions prior to Lenovo’s advisory update are impacted.

The CVSS score of 6.8 indicates a medium severity for this local‑privileged vulnerability. The EPSS score is under 1%, showing a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local privileged, requiring the attacker to already possess administrative access on the target machine to manipulate BIOS power settings. In environments where local admin rights are tightly controlled the risk is mitigated, whereas systems with more permissive local privileges face a higher exploitation possibility for modifying power configurations or building a foothold for deeper attacks.