Buffer Overflow Vulnerability in Insydes Tool Package
CVE-2025-12053

7.8HIGH

Key Information:

Vendor

Insyde Software

Status
Insydeh2o Tools
Vendor
CVE Published:
14 January 2026

What is CVE-2025-12053?

The Insyde tool package contains a vulnerability that allows an untrusted user-mode application to exploit a buffer overflow through the RTL_QUERY_REGISTRY_DIRECT flag used to read registry values. This flaw could enable an attacker to manipulate memory and execute arbitrary code, posing significant security risks to systems utilizing this software.

Affected Version(s)

InsydeH2O tools Windows See in the Solution

References

https://www.insyde.com/security-pledge/sa-2025010/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.