Arbitrary Code Execution in SMM for Insyde Software
CVE-2025-10451

8.2HIGH

Key Information:

Vendor

Insyde Software

Status
Insydeh2o
Vendor
CVE Published:
12 December 2025

What is CVE-2025-10451?

The vulnerability arises from an unchecked output buffer in the System Management Mode (SMM) of Insyde Software, which can allow an attacker to execute arbitrary code. This flaw has the potential to corrupt SMM memory, posing serious risks to the security and integrity of the system. Mitigation measures should be actively implemented to prevent exploitation of this vulnerability.

Affected Version(s)

InsydeH2O HP feature version before 20C1

References

https://www.insyde.com/security-pledge/sa-2025009/

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.