Insyde Software InsydeH2O vulnerabilities

CVEs per yearBy the year they were published

1. 202511
2. 20267

Newest CVEs

• CVE-2026-12855

  H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.

  Insyde Software · InsydeH2O

  High8.2
• CVE-2026-6485

  UEFI BIOS embedded Shell can be used to bypass Secure Boot

  Insyde Software · InsydeH2O

  High8.2
• CVE-2021-38489

  HDD Password Stored In Plaintext

  Insyde Software · InsydeH2O

  High8.2
• CVE-2021-43614

  VariableEditSmm: Error checking of UEFI variables could cause buffer overflow, leading to code execution

  Insyde Software · InsydeH2O

  Medium6.7
• CVE-2021-43613

  SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege

  Insyde Software · InsydeH2O

  Medium6.5
• CVE-2026-9805

  FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow

  Insyde Software · InsydeH2O

  Low2.7
• CVE-2026-6484

  Lack of verified boot to certain FV may cause arbitrary code execution

  Insyde Software · InsydeH2O

  High8.2
• CVE-2025-10451

  H19Int15CallbackSmm: SMM memory corruption vulnerability in combined DXE/SMM (SMRAM write)

  Insyde Software · InsydeH2O

  High8.2
• CVE-2025-4410

  SetupUtility: A buffer overflow vulnerability leads to arbitrary code execution.

  Insyde Software · InsydeH2O

  High7.5
• CVE-2025-4277

  Tcg2Smm: improper input validation may lead to arbitrary code execution

  Insyde Software · InsydeH2O

  High7.5