Insyde Software Insydeh2o
18 CVEs affecting Insyde Software Insydeh2o. Latest disclosed: 2026-09-09. Critical: 0, High: 13.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6485 | High | 8.2 | 2026-09-09 | UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts. |
CVE-2026-12855 | High | 8.2 | 2026-09-09 | Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects. |
CVE-2021-38489 | High | 8.2 | 2026-09-03 | HDD password plaintext is stored in a UEFI variable. |
CVE-2026-6484 | High | 8.2 | 2026-08-12 | In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution. |
CVE-2025-10451 | High | 8.2 | 2025-12-12 | Unchecked output buffer may allowed arbitrary code execution in SMM and potentially result in SMM memory corruption. |
CVE-2025-4425 | High | 8.2 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-4423 | High | 8.2 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-4422 | High | 8.2 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-4421 | High | 8.2 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-4275 | High | 7.8 | 2025-06-11 | A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verif… |
CVE-2025-4410 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability exists in the module SetupUtility. An attacker with local privileged access can exploit this vulnerability by executeing arbitr… |
CVE-2025-4277 | High | 7.5 | 2025-08-13 | Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level. |
CVE-2025-4276 | High | 7.5 | 2025-08-13 | UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level. |
CVE-2021-43614 | Medium | 6.7 | 2026-09-03 | Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure. |
CVE-2021-43613 | Medium | 6.5 | 2026-09-03 | An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalat… |
CVE-2025-4426 | Medium | 6.0 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-4424 | Medium | 6.0 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2026-9805 | Low | 2.7 | 2026-08-26 | SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow. |