EUVD-2026-74615
GHSA-w7c8-hp3q-qpv8
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Local attack requiring high OS privileges; scope change to SMM context justifies S:C and full C/I/A impact on out-of-scope firmware.
Primary rating from Vendor (8338d8cb-57f7-4252-abc0-96fd13e98d21).
CVSS VectorVendor: 8338d8cb-57f7-4252-abc0-96fd13e98d21
Lifecycle Timeline
2DescriptionCVE.org
Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.
AnalysisAI
Arbitrary code execution at firmware privilege level is possible in InsydeH2O UEFI firmware code developed specifically for HP-branded systems, exploitable by a local attacker with high OS-level privileges. The root cause is an unvalidated memory boundary (CWE-20), consistent with an SMM (System Management Mode) handler that fails to verify caller-supplied buffer boundaries, allowing memory corruption that escapes the OS privilege boundary into firmware-controlled memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold high OS-level privileges (kernel-mode or equivalent, PR:H) on a physical or virtualized HP system running the affected InsydeH2O UEFI firmware build. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.2 with AV:L/PR:H/S:C/C:H/I:H/A:H accurately characterizes this as a local privilege escalation to SMM, not a remotely triggerable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Obtain and apply the updated firmware package from HP's support portal corresponding to the affected system model, referencing Insyde SA-2026009 at https://www.insyde.com/security-pledge/sa-2026009/ to identify the fixed firmware version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all HP systems in your environment and document their InsydeH2O firmware versions through BIOS interrogation or system records. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software co
HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle
Remote code execution in Adobe Flash Player allows network attackers to execute arbitrary code via integer overflow expl
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary cod
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown
Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoP
Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execu
UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown ve
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today