What’s Vulnerable › Vulnerabilities

CVE-2025-4275: SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-11 · updated 2026-06-17

Description

A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable. An attacker may to execute arbitrary signed UEFI code and bypass Secure Boot.

Affected products

• Insyde Software InsydeH2O: from Kernel 5.2 before 05.2A.16; from Kernel 5.3 before 05.39.16; from Kernel 5.4 before 05.47.16; from Kernel 5.5 before 05.55.16; from Kernel 5.6 before 05.62.16; from Kernel 5.7 before 05.71.16 — fixed in 05.2A.16, 05.39.16, 05.47.16, 05.55.16, 05.62.16, 05.71.16

How to fix

Upgrade to a fixed version: Insyde Software InsydeH2O 05.2A.16, 05.39.16, 05.47.16, 05.55.16. Check the vendor advisory for mitigations.

References

• https://www.insyde.com/security-pledge/sa-2025002/
• https://www.kb.cert.org/vuls/id/211341

Get alerted when CVE-2025-4275 or the next vulnerability affects your stack