CVE-2022-36448

HIGH

Insyde InsydeH2O 5.0-5.5 - SMM Memory Corruption via PnpSmm Driver

Title source: llm

Description

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the PnpSmm driver.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_misc

https://www.insyde.com/security-pledge

Exploit, Third Party Advisory x_refsource_misc

https://binarly.io/advisories/BRLY-2022-023/index.html

Vendor Advisory x_refsource_misc

https://www.insyde.com/security-pledge/SA-2022032

Scores

CVSS v3 8.2

EPSS 0.0032

EPSS Percentile 23.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-20

Status published

Products (1)

insyde/insydeh2o 5.4 - 05.44.30

Published Sep 28, 2022

Tracked Since Feb 18, 2026