InsydeH2O CVE-2026-9805

Exploitation requires all of the following conditions to be satisfied simultaneously: physical access to the target device is mandatory (AV:P - remote exploitation is categorically impossible); the attacker must already hold high-privilege credentials or equivalent OS-level access (PR:H - unauthenticated exploitation is impossible); attack complexity is high (AC:H), meaning specific, non-trivial sequencing involving the SMM IHISI interface and FMTS command 0x32 invocation must be achieved; and some form of user interaction is required (UI:R). The specific SMM handler FMTSWriteUseIntelLib for command 0x32 must be reachable and invoked with a crafted oversized buffer payload. Limiting factors include: no network reachability (physical access only), no unauthenticated path (high privilege mandatory), non-trivial exploitation mechanics (high complexity), and scope unchanged meaning the vulnerability does not provide lateral movement or OS escape beyond local firmware memory corruption.

The CVSS 3.1 base score of 2.7 (Low) with vector AV:P/AC:H/PR:H/UI:R accurately reflects an extraordinarily restricted attack scenario requiring physical presence, pre-existing high privilege, high attack complexity, and user interaction - all simultaneously. No EPSS data was provided in the available intelligence. The vulnerability carries no CISA KEV listing and no known public exploit code, indicating no observed active or opportunistic exploitation. Despite SMM vulnerabilities historically representing severe threats due to Ring -2 execution scope, the access prerequisites in this case fundamentally limit practical risk: this is non-remotely exploitable, non-anonymously exploitable, and not reliably triggered without specific coordination. The assessed impact is bounded at low integrity and low availability effects with no confidentiality impact, and scope remains unchanged - meaning the attacker cannot leverage this vulnerability to escape the local system context per the vendor's own assessment. This is a low-priority finding for most organizations; meaningful risk exists only in environments where physical device access by untrusted parties is a modeled threat.

An attacker who has already obtained high-privilege access to the target system and has physical presence triggers the SMM IHISI FMTS command 0x32 handler by invoking FMTSWriteUseIntelLib with a crafted request containing a buffer exceeding expected size bounds. The handler processes the operation without bounds checking, causing an out-of-bounds write in SMM memory that may corrupt firmware data structures, affecting system integrity or stability. No public proof-of-concept code exists, and this scenario demands coordinated physical access and privileged account control simultaneously.