Skip to content
OpenAdvisories
High · 7.5 CVE-2025-4276 EUVD-2025-24533GHSA-rx4h-pwfx-x49f

UsbCoreDxe: improper input validation may lead to arbitrary code execution

Published Aug 13, 2025 · Updated Aug 14, 2025 · Assigned by Insyde

Vendor: Insyde Software Product: InsydeH2O

Description

UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.

Affected products

VendorProductAffectedFixed
Insyde Software InsydeH2O Kernel 5.3 – < 05.39.18, Kernel 5.4 – < 05.47.18, Kernel 5.5 – < 05.55.18, Kernel 5.6 – < 05.62.18, Kernel 5.7 – < 05.71.18 05.39.18

Advisories 1

References