What’s Vulnerable › Vulnerabilities
CVE-2025-4276: UsbCoreDxe: improper input validation may lead to arbitrary code execution
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-08-13 · updated 2026-06-17
- Weakness: CWE-20
Description
UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
Affected products
- Insyde Software InsydeH2O: from Kernel 5.3 before 05.39.18; from Kernel 5.4 before 05.47.18; from Kernel 5.5 before 05.55.18; from Kernel 5.6 before 05.62.18; from Kernel 5.7 before 05.71.18 — fixed in 05.39.18, 05.47.18, 05.55.18, 05.62.18, 05.71.18
How to fix
Upgrade to a fixed version: Insyde Software InsydeH2O 05.39.18, 05.47.18, 05.55.18, 05.62.18. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-4276 or the next vulnerability affects your stack