CVE-2025-4276 Details
Description
UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
A vulnerability in the UsbCoreDxe module of InsydeH2O firmware allows for arbitrary memory writes within SMRAM, enabling the execution of arbitrary code at the SMM level. This issue arises from improper input validation.
Users can upgrade to InsydeH2O versions 05.39.18 (Kernel 5.3), 05.47.18 (Kernel 5.4), 05.55.18 (Kernel 5.5), 05.62.18 (Kernel 5.6) or 05.71.18 (Kernel 5.7) to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 13, 2025CISA-ADP
Assessed Aug 13, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.insyde.com/security-pledge/sa-2025005/ | Insyde | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | Insyde |
Affected Products
| Product | Versions |
|---|---|
| InsydeH2O | >= 5.3, < 5.3.18 >= 5.4, < 5.4.18 >= 5.5, < 5.5.18 >= 5.6, < 5.6.18 >= 5.7, < 5.7.18 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | Insyde |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 13, 2025 | New CVE Received | Insyde |