Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-4277

Tcg2Smm: improper input validation may lead to arbitrary code execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Insyde

Description

Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Insyde Software InsydeH2O

Default version status: unknown

  • Kernel 5.2 to < 05.2A.21affected
  • Kernel 5.3 to < 05.39.21affected
  • Kernel 5.4 to < 05.47.21affected
  • Kernel 5.5 to < 05.55.21affected
  • Kernel 5.6 to < 05.62.21affected
  • Kernel 5.7 to < 05.71.21affected

References