CVE-2026-12855
H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.
Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.
Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.
- Record
CVE-2026-12855- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-74615
Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.
- Record
EUVD-2026-74615- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w7c8-hp3q-qpv8
Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in...
Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.
- Record
GHSA-w7c8-hp3q-qpv8- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.
- Record
CVE-2026-12855- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-12855 is a high vulnerability (CVSS 8.2) in Insyde Software Insydeh2o, published September 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. No source names a fixed version.