Skip to content
OpenAdvisories
High · 7.5 CVE-2025-4277 EUVD-2025-24532GHSA-xcpg-24q4-26m3

Tcg2Smm: improper input validation may lead to arbitrary code execution

Published Aug 13, 2025 · Updated Aug 14, 2025 · Assigned by Insyde

Vendor: Insyde Software Product: InsydeH2O

Description

Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.

Affected products

VendorProductAffectedFixed
Insyde Software InsydeH2O Kernel 5.2 – < 05.2A.21, Kernel 5.3 – < 05.39.21, Kernel 5.4 – < 05.47.21, Kernel 5.5 – < 05.55.21, Kernel 5.6 – < 05.62.21, Kernel 5.7 – < 05.71.21 05.2A.21

Advisories 1

References