Insyde Software InsydeH2O vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Insyde Software InsydeH2O: 7 record(s), with affected versions and fixes.

CVE-2026-6485 High · 8.2 CWE-489 Sep 9, 2026

UEFI BIOS embedded Shell can be used to bypass Secure Boot

UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.

CVE-2026-12855 High · 8.2 CWE-20 Sep 9, 2026

H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.

Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.

CVE-2021-43614 Medium · 6.7 CWE-120 Sep 3, 2026

VariableEditSmm: Error checking of UEFI variables could cause buffer overflow, leading to code execution

Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure.

CVE-2021-43613 Medium · 6.5 CWE-732 Sep 3, 2026

SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege

CVE-2021-38489 High · 8.2 CWE-256 Sep 3, 2026

HDD Password Stored In Plaintext

HDD password plaintext is stored in a UEFI variable.

CVE-2026-9805 Low · 2.7 CWE-787 Aug 26, 2026

FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow

SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow.

CVE-2025-10451 High · 8.2 CWE-787 Dec 11, 2025

H19Int15CallbackSmm: SMM memory corruption vulnerability in combined DXE/SMM (SMRAM write)

Unchecked output buffer may allowed arbitrary code execution in SMM and potentially result in SMM memory corruption.