Multiple security vulnerabilities have been found in the BIOS of various Lenovo computers. A local attacker can exploit them to execute code, manipulate data, expose information, cause denial-of-service conditions and escalate privileges. The breadth of those potential impacts reflects how deeply these vulnerabilities are embedded in the system architecture.
BIOS vulnerabilities are especially sensitive because the BIOS sits below the operating system and remains active even when the OS is not yet running or has been shut down. Code executed at the BIOS level can completely bypass security mechanisms in the operating system.
What to Do
Check Lenovo's support page to see whether a BIOS update is available for your specific device model. BIOS updates usually need to be downloaded and applied manually. If you use a company-owned device, contact your IT team.