CVE-2020-27339

An issue was discovered in IdeBusDxe in Insyde InsydeH2O 5.x. Code in system management mode...

6.7 Medium

In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt either the firmware or the OS memory. The fixed versions for this issue in the AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe, and SdMmcDeviceDxe drivers are 05.16.25, 05.26.25, 05.35.25, 05.43.25, and 05.51.25 (for Kernel 5.1 through 5.5).

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.32%Down 0.3 points since Jun 17, 2021

What each source reports

NVD Score used 6.7

Record: CVE-2020-27339
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2020-27339
Updated: 2026-11-02

EUVDEUVD-2020-19852 No score

Record: EUVD-2020-19852
Updated: 2026-11-02

GitHub AdvisoriesGHSA-67f6-6h83-3w53 6.7

An issue was discovered in IdeBusDxe in Insyde InsydeH2O 5.x. Code in system management mode...

An issue was discovered in IdeBusDxe in Insyde InsydeH2O 5.x. Code in system management mode calls a function outside of SMRAM in response to a crafted software SMI, aka Inclusion of Functionality from an Untrusted Control Sphere. Modifying the well-known address of this function allows an attacker to gain control of the system with the privileges of system management mode.

Record: GHSA-67f6-6h83-3w53
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-20, CWE-269
Updated: 2026-11-02

Affected products

Show 23 moreShow less

History

History
Recorded	Changed	Sources
Nov 10, 2026	facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-27339 is a medium vulnerability (CVSS 6.7) in Insyde Insydeh2o, published June 16, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. No source names a fixed version.