EUVD-2026-66226
GHSA-q9cj-25hp-849c
Severity by source
AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Physical presence and high privileges required to invoke SMM IHISI command 0x32; limited out-of-bounds write with no confidentiality impact and unchanged scope.
Primary rating from Vendor (Insyde).
CVSS VectorVendor: Insyde
CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow.
AnalysisAI
SMM buffer overflow in InsydeH2O's IHISI command handler for FMTS command 0x32 allows a physically-present, highly-privileged attacker to trigger out-of-bounds writes in System Management Mode firmware. The vulnerable function FMTSWriteUseIntelLib performs read and write operations without validating buffer sizes, enabling potential firmware-level memory corruption in Ring -2 execution context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions to be satisfied simultaneously: physical access to the target device is mandatory (AV:P - remote exploitation is categorically impossible); the attacker must already hold high-privilege credentials or equivalent OS-level access (PR:H - unauthenticated exploitation is impossible); attack complexity is high (AC:H), meaning specific, non-trivial sequencing involving the SMM IHISI interface and FMTS command 0x32 invocation must be achieved; and some form of user interaction is required (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 2.7 (Low) with vector AV:P/AC:H/PR:H/UI:R accurately reflects an extraordinarily restricted attack scenario requiring physical presence, pre-existing high privilege, high attack complexity, and user interaction - all simultaneously. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already obtained high-privilege access to the target system and has physical presence triggers the SMM IHISI FMTS command 0x32 handler by invoking FMTSWriteUseIntelLib with a crafted request containing a buffer exceeding expected size bounds. The handler processes the operation without bounds checking, causing an out-of-bounds write in SMM memory that may corrupt firmware data structures, affecting system integrity or stability. … |
| Remediation | The primary remediation is to apply the patched InsydeH2O firmware update referenced in Insyde Software's security advisory at https://www.insyde.com/security-pledge/sa-2026006/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.8)
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.2), this vulnerabil
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.2), this vulnerabil
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.2), this vulnerabil
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.2), this vulnerabil
An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. Rated high severity (CVSS 7.8), this vulnerabil
Arbitrary code execution at the firmware level is possible in Insyde Software's InsydeH2O UEFI implementation due to the
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated medium severity (CVSS 6.0), this vulnerab
An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5
A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 all
A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.4
An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.8), thi
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today