The vulnerability allows a local privileged user to read the address of Protected System Management Mode (SMRAM) memory. This constitutes a disclosure of sensitive firmware memory location. The CVE description does not indicate the ability to read SMRAM contents or to execute code; therefore the impact is limited to information disclosure of memory boundaries.

All Lenovo laptops whose BIOS firmware belongs to the IdeaPad, Legion, ThinkBook, Yoga, Legion Pro, and Loq product families are affected. The advisory lists a wide range of models such as the IdeaPad 5 15ABA7, Legions Pro 5 16ADR10, and Yoga 9 14IRP8, covering consumer, business, and gaming notebooks.

The CVSS score of 6.7 signals moderate severity, and the EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation. The attack vector is local and requires privileged access on the host. An attacker with such access can determine SMRAM boundaries, which may assist advanced firmware attacks, but no direct code execution or remote exploitation is described.