Insyde Software
Monthly
Secure Boot bypass in InsydeH2O UEFI firmware allows a locally-privileged attacker to leverage the embedded UEFI Shell to execute shell commands or startup scripts that circumvent Secure Boot integrity enforcement, enabling pre-OS code execution outside the chain of trust. The vulnerability affects InsydeH2O across all tracked versions per the CPE wildcard, with remediation details deferred to OEM-specific advisories referenced in Insyde SA-2026004. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope change to C:H/I:H/A:H reflects the catastrophic trust boundary violation once exploited.
Arbitrary code execution at the firmware level is possible in Insyde Software's InsydeH2O UEFI implementation due to the absence of verified boot enforcement on certain Firmware Volumes (FVs). A local attacker holding high-privileged OS or physical access can inject unsigned or tampered code into unverified FVs, achieving persistent below-OS execution that survives operating system reinstalls and standard endpoint security controls. No public exploit has been identified at time of analysis, and this vulnerability has not been listed in the CISA Known Exploited Vulnerabilities catalog.
SMM buffer overflow in InsydeH2O's IHISI command handler for FMTS command 0x32 allows a physically-present, highly-privileged attacker to trigger out-of-bounds writes in System Management Mode firmware. The vulnerable function FMTSWriteUseIntelLib performs read and write operations without validating buffer sizes, enabling potential firmware-level memory corruption in Ring -2 execution context. No active exploitation has been identified and no public exploit exists; the combination of physical access, high privilege, high attack complexity, and required user interaction makes real-world risk extremely low despite the sensitive SMM execution environment.
Secure Boot bypass in InsydeH2O UEFI firmware allows a locally-privileged attacker to leverage the embedded UEFI Shell to execute shell commands or startup scripts that circumvent Secure Boot integrity enforcement, enabling pre-OS code execution outside the chain of trust. The vulnerability affects InsydeH2O across all tracked versions per the CPE wildcard, with remediation details deferred to OEM-specific advisories referenced in Insyde SA-2026004. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope change to C:H/I:H/A:H reflects the catastrophic trust boundary violation once exploited.
Arbitrary code execution at the firmware level is possible in Insyde Software's InsydeH2O UEFI implementation due to the absence of verified boot enforcement on certain Firmware Volumes (FVs). A local attacker holding high-privileged OS or physical access can inject unsigned or tampered code into unverified FVs, achieving persistent below-OS execution that survives operating system reinstalls and standard endpoint security controls. No public exploit has been identified at time of analysis, and this vulnerability has not been listed in the CISA Known Exploited Vulnerabilities catalog.
SMM buffer overflow in InsydeH2O's IHISI command handler for FMTS command 0x32 allows a physically-present, highly-privileged attacker to trigger out-of-bounds writes in System Management Mode firmware. The vulnerable function FMTSWriteUseIntelLib performs read and write operations without validating buffer sizes, enabling potential firmware-level memory corruption in Ring -2 execution context. No active exploitation has been identified and no public exploit exists; the combination of physical access, high privilege, high attack complexity, and required user interaction makes real-world risk extremely low despite the sensitive SMM execution environment.