What’s Vulnerable › Products

Insyde Software InsydeH2O vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.

Check whether your Insyde Software InsydeH2O version is affected

Latest Insyde Software InsydeH2O vulnerabilities

• CVE-2026-6485 — UEFI BIOS embedded Shell can be used to bypass Secure Boot (CVSS 8.2)
• CVE-2026-12855 — H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution. (CVSS 8.2)
• CVE-2021-43614 — VariableEditSmm: Error checking of UEFI variables could cause buffer overflow, leading to code execution (CVSS 6.7)
• CVE-2021-43613 — SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege (CVSS 6.5)
• CVE-2021-38489 — HDD Password Stored In Plaintext (CVSS 8.2)
• CVE-2026-9805 — FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow (CVSS 2.7)
• CVE-2025-10451 — H19Int15CallbackSmm: SMM memory corruption vulnerability in combined DXE/SMM (SMRAM write) (CVSS 8.2)
• CVE-2025-4410 — SetupUtility: A buffer overflow vulnerability leads to arbitrary code execution. (CVSS 7.5)
• CVE-2025-4277 — Tcg2Smm: improper input validation may lead to arbitrary code execution (CVSS 7.5)
• CVE-2025-4276 — UsbCoreDxe: improper input validation may lead to arbitrary code execution (CVSS 7.5)
• CVE-2025-4426 — SetupAutomationSmm : SMRAM memory contents leak / information disclosure vulnerability in SMM module (CVSS 6.0)
• CVE-2025-4425 — SetupAutomationSmm: Stack overflow vulnerability in SMI handler (CVSS 8.2)
• CVE-2025-4424 — SetupAutomationSmm : Arbitrary calls to SmmSetVariable with unsanitised arguments in SMI handler (CVSS 6.0)
• CVE-2025-4423 — SetupAutomationSmm:Vulnerability in the SMM module allow attacker to write arbitrary code and lead to memory corruption (CVSS 8.2)
• CVE-2025-4422 — EfiSmiServices : EfiPcdProtocol, SMM memory corruption vulnerabilities in SMM module (CVSS 8.2)
• CVE-2025-4421 — EfiSmiServices: gEfiSmmCpuProtocol, SMM memory corruption vulnerabilities in SMM module (CVSS 8.2)
• CVE-2025-4275 — SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate (CVSS 7.8)