Insyde Software vulnerabilities

CVEs per yearBy the year they were published

1. 202511
2. 202612

Newest CVEs

• CVE-2026-12855

  H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.

  Insyde Software · InsydeH2O

  High8.2
• CVE-2026-6485

  UEFI BIOS embedded Shell can be used to bypass Secure Boot

  Insyde Software · InsydeH2O

  High8.2
• CVE-2021-38489

  HDD Password Stored In Plaintext

  Insyde Software · InsydeH2O

  High8.2
• CVE-2021-43614

  VariableEditSmm: Error checking of UEFI variables could cause buffer overflow, leading to code execution

  Insyde Software · InsydeH2O

  Medium6.7
• CVE-2021-43613

  SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege

  Insyde Software · InsydeH2O

  Medium6.5
• CVE-2026-9805

  FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow

  Insyde Software · InsydeH2O

  Low2.7
• CVE-2026-8810

  HDD Password leakage vulnerability

  Insyde Software · InsydeH2O, InsydeH2O ARM

  Medium6.9
• CVE-2026-6484

  Lack of verified boot to certain FV may cause arbitrary code execution

  Insyde Software · InsydeH2O

  High8.2
• CVE-2025-12053

  egwindrvx64.sys is potentially vulnerable to a buffer overflow

  Insyde Software · InsydeH2O tools

  High7.8
• CVE-2025-12052

  egwindrv.sys is potentially vulnerable to a buffer overflow.

  Insyde Software · InsydeH2O tools

  High7.8