Insyde Software vulnerabilities

Products

• Insydeh2o 18
• Insydeh2o Tools 4

Newest

• insyde software insydeh2o H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution. CVE-2026-12855 8.2 HighSeptember 9, 2026
• insyde software insydeh2o UEFI BIOS embedded Shell can be used to bypass Secure Boot CVE-2026-6485 8.2 HighSeptember 9, 2026
• insyde software insydeh2o HDD Password Stored In Plaintext CVE-2021-38489 8.2 HighSeptember 3, 2026
• insyde software insydeh2o VariableEditSmm: Error checking of UEFI variables could cause buffer overflow, leading to code execution CVE-2021-43614 6.7 MediumSeptember 3, 2026
• insyde software insydeh2o SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege CVE-2021-43613 6.5 MediumSeptember 3, 2026
• insyde software insydeh2o FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow CVE-2026-9805 2.7 LowAugust 26, 2026
• insyde software insydeh2o, insydeh2o arm HDD Password leakage vulnerability CVE-2026-8810 6.9 MediumAugust 19, 2026
• insyde software insydeh2o Lack of verified boot to certain FV may cause arbitrary code execution CVE-2026-6484 8.2 HighAugust 12, 2026
• insyde software insydeh2o tools egwindrvx64.sys is potentially vulnerable to a buffer overflow CVE-2025-12053 7.8 HighJanuary 14, 2026
• insyde software insydeh2o tools egwindrv.sys is potentially vulnerable to a buffer overflow. CVE-2025-12052 7.8 HighJanuary 14, 2026
• insyde software insydeh2o tools H2OFFT64.sys is potentially vulnerable to a buffer overflow. CVE-2025-12051 7.8 HighJanuary 14, 2026
• insyde software insydeh2o tools In H2OFFT32.sys is potentially vulnerable to a buffer overflow. CVE-2025-12050 7.8 HighJanuary 14, 2026
• insyde software insydeh2o H19Int15CallbackSmm: SMM memory corruption vulnerability in combined DXE/SMM (SMRAM write) CVE-2025-10451 8.2 HighDecember 12, 2025
• insyde software insydeh2o SetupUtility: A buffer overflow vulnerability leads to arbitrary code execution. CVE-2025-4410 7.5 HighAugust 13, 2025
• insyde software insydeh2o Tcg2Smm: improper input validation may lead to arbitrary code execution CVE-2025-4277 7.5 HighAugust 13, 2025
• insyde software insydeh2o UsbCoreDxe: improper input validation may lead to arbitrary code execution CVE-2025-4276 7.5 HighAugust 13, 2025
• insyde software insydeh2o SetupAutomationSmm : SMRAM memory contents leak / information disclosure vulnerability in SMM module CVE-2025-4426 6.0 MediumJuly 30, 2025
• insyde software insydeh2o SetupAutomationSmm: Stack overflow vulnerability in SMI handler CVE-2025-4425 8.2 HighJuly 30, 2025
• insyde software insydeh2o SetupAutomationSmm : Arbitrary calls to SmmSetVariable with unsanitised arguments in SMI handler CVE-2025-4424 6.0 MediumJuly 30, 2025
• insyde software insydeh2o SetupAutomationSmm:Vulnerability in the SMM module allow attacker to write arbitrary code and lead to memory corruption CVE-2025-4423 8.2 HighJuly 30, 2025
• insyde software insydeh2o EfiSmiServices : EfiPcdProtocol, SMM memory corruption vulnerabilities in SMM module CVE-2025-4422 8.2 HighJuly 30, 2025
• insyde software insydeh2o EfiSmiServices: gEfiSmmCpuProtocol, SMM memory corruption vulnerabilities in SMM module CVE-2025-4421 8.2 HighJuly 30, 2025
• insyde software insydeh2o SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate CVE-2025-4275 Public exploit 7.8 HighJune 11, 2025