Vendor
Insyde Software
22 known vulnerabilities in products by Insyde Software, 0 of them actively exploited (CISA KEV).
Key figures
22
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-12855 | Insyde Software InsydeH2O: Improper Input Validation | 8.2 | |
| High | CVE-2026-6485 | UEFI BIOS embedded Shell can be used to bypass Secure Boot | 8.2 | |
| High | CVE-2021-38489 | HDD Password Stored In Plaintext | 8.2 | |
| High | CVE-2025-4275 | SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate | 7.8 | |
| High | CVE-2025-10451 | H19Int15CallbackSmm: SMM memory corruption vulnerability in combined DXE/SMM (SMRAM write) | 8.2 | |
| Medium | CVE-2021-43614 | Insyde Software InsydeH2O: Buffer Overflow | 6.7 | |
| Medium | CVE-2026-8810 | HDD Password leakage vulnerability | 6.9 | |
| Medium | CVE-2021-43613 | Insyde Software InsydeH2O: Incorrect Permission Assignment for Critical Resource | 6.5 | |
| High | CVE-2025-4421 | EfiSmiServices: gEfiSmmCpuProtocol, SMM memory corruption vulnerabilities in SMM module | 8.2 | |
| High | CVE-2025-12050 | Insyde Software InsydeH2O tools: Out-of-bounds Write | 7.8 | |
| High | CVE-2025-12053 | egwindrvx64.sys is potentially vulnerable to a buffer overflow | 7.8 | |
| High | CVE-2025-12052 | Insyde Software InsydeH2O tools: Out-of-bounds Write | 7.8 | |
| High | CVE-2025-12051 | Insyde Software InsydeH2O tools: Out-of-bounds Write | 7.8 | |
| High | CVE-2025-4422 | EfiSmiServices : EfiPcdProtocol, SMM memory corruption vulnerabilities in SMM module | 8.2 | |
| High | CVE-2025-4425 | SetupAutomationSmm: Stack overflow vulnerability in SMI handler | 8.2 | |
| High | CVE-2025-4423 | Insyde Software InsydeH2O: Improper Restriction of Operations within the Bounds of a Memory Buffer | 8.2 | |
| High | CVE-2025-4277 | Tcg2Smm: improper input validation may lead to arbitrary code execution | 7.5 | |
| High | CVE-2025-4276 | UsbCoreDxe: improper input validation may lead to arbitrary code execution | 7.5 | |
| High | CVE-2025-4410 | Insyde Software InsydeH2O: Improper Input Validation | 7.5 | |
| Low | CVE-2026-9805 | FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow | 2.7 | |
| Medium | CVE-2025-4426 | SetupAutomationSmm : SMRAM memory contents leak / information disclosure vulnerability in SMM module | 6.0 | |
| Medium | CVE-2025-4424 | SetupAutomationSmm : Arbitrary calls to SmmSetVariable with unsanitised arguments in SMI handler | 6.0 |
Products
| Insydeh2o | 17 | 0 |
| Insydeh2o Tools | 4 | 0 |