EUVD-2026-57052
GHSA-gh4j-3cg6-8m5x
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Local access and high OS privileges required to write firmware storage; Scope Change reflects firmware-level execution escaping OS trust boundary with full C/I/A impact on the broader platform.
Primary rating from Vendor (Insyde).
CVSS VectorVendor: Insyde
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.
AnalysisAI
Arbitrary code execution at the firmware level is possible in Insyde Software's InsydeH2O UEFI implementation due to the absence of verified boot enforcement on certain Firmware Volumes (FVs). A local attacker holding high-privileged OS or physical access can inject unsigned or tampered code into unverified FVs, achieving persistent below-OS execution that survives operating system reinstalls and standard endpoint security controls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access with high operating-system privileges (PR:H, AV:L per CVSS) - the attacker must be able to write to firmware storage, which on most platforms requires kernel-level or administrator-equivalent access, physical access to the device, or prior exploitation of a vulnerability that grants such access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is elevated despite requiring high privileges because the Scope Changed metric captures the critical reality that successful exploitation breaks out of the OS trust boundary into firmware - a security domain that persists across reboots and full OS reinstalls. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained administrative privileges on a target system - or has brief physical access - identifies the Firmware Volume not subject to verified boot verification, injects a malicious UEFI module into that volume, and causes it to execute during the pre-OS boot phase. The implanted code runs with firmware-level privilege, can disable security features such as Secure Boot on subsequent boots, and persists through OS reinstallation. … |
| Remediation | Consult the Insyde Software security advisory SA-2026003 at https://www.insyde.com/security-pledge/sa-2026003/ for patched firmware versions and OEM-specific update instructions, as UEFI patches are typically distributed through OEM firmware update channels rather than directly from Insyde. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of systems using Insyde H2O UEFI firmware and classify by business criticality; notify infrastructure and security leadership of the exposure and affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.8)
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.2), this vulnerabil
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.2), this vulnerabil
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.2), this vulnerabil
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.2), this vulnerabil
An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. Rated high severity (CVSS 7.8), this vulnerabil
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated medium severity (CVSS 6.0), this vulnerab
An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5
A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 all
A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.4
An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.8), thi
An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. Rated high severity (CVSS 8.8), thi
Share
External POC / Exploit Code
Leaving vuln.today