Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-4276

UsbCoreDxe: improper input validation may lead to arbitrary code execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Insyde

Description

UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Insyde Software InsydeH2O

Default version status: unknown

  • Kernel 5.3 to < 05.39.18affected
  • Kernel 5.4 to < 05.47.18affected
  • Kernel 5.5 to < 05.55.18affected
  • Kernel 5.6 to < 05.62.18affected
  • Kernel 5.7 to < 05.71.18affected

References