What’s Vulnerable › Vulnerabilities
CVE-2025-4277: Tcg2Smm: improper input validation may lead to arbitrary code execution
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-08-13 · updated 2026-06-17
- Weakness: CWE-20
Description
Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
Affected products
- Insyde Software InsydeH2O: from Kernel 5.2 before 05.2A.21; from Kernel 5.3 before 05.39.21; from Kernel 5.4 before 05.47.21; from Kernel 5.5 before 05.55.21; from Kernel 5.6 before 05.62.21; from Kernel 5.7 before 05.71.21 — fixed in 05.2A.21, 05.39.21, 05.47.21, 05.55.21, 05.62.21, 05.71.21
How to fix
Upgrade to a fixed version: Insyde Software InsydeH2O 05.2A.21, 05.39.21, 05.47.21, 05.55.21. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-4277 or the next vulnerability affects your stack