{"id":"CVE-2026-12855","state":"PUBLISHED","title":"H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.","description":"Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.","publishedAt":"2026-09-09T03:59:11.348Z","updatedAt":"2026-10-01T15:08:22.356Z","severity":{"score":8.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"Insyde"},"assigner":"Insyde","products":["Insyde Software InsydeH2O"],"affected":[{"vendor":"Insyde Software","product":"InsydeH2O","defaultStatus":"unaffected","versions":[{"version":"See in the Solution","status":"affected"}],"platforms":["x86"]}],"references":["https://www.insyde.com/security-pledge/sa-2026009/","https://www.kb.cert.org/vuls/id/553437"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/12xxx/CVE-2026-12855.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-12855","state":"PUBLISHED","datePublished":"2026-09-09T03:59:11.348Z","dateUpdated":"2026-10-01T15:08:22.356Z","assignerShortName":"Insyde","assignerOrgId":"8338d8cb-57f7-4252-abc0-96fd13e98d21","dateReserved":"2026-06-22T05:49:02.853Z"},"containers":{"cna":{"title":"H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.","descriptions":[{"lang":"en","value":"Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects."}],"affected":[{"vendor":"Insyde Software","product":"InsydeH2O","defaultStatus":"unaffected","versions":[{"version":"See in the Solution","status":"affected"}],"platforms":["x86"]}],"references":[{"url":"https://www.insyde.com/security-pledge/sa-2026009/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.2,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","lang":"en","description":"CWE-20: Improper Input Validation","type":"CWE"}]}],"providerMetadata":{"shortName":"Insyde","orgId":"8338d8cb-57f7-4252-abc0-96fd13e98d21","dateUpdated":"2026-09-09T03:59:11.348Z"},"datePublic":"2026-09-09T03:56:00.000Z","solutions":[{"lang":"en","value":"HP feature version\n– Platform 5.4: 05.47.2701.2631\n– Platform 5.5: 05.55.45.2630\n– Platform 5.6: 05.62.29.2630\n– Platform 5.7: 05.72.21.2630\n– Platform 6.0: 06.01.23.2630","supportingMedia":[{"type":"text/html","base64":false,"value":"HP feature version<br>– Platform 5.4: 05.47.2701.2631<br>– Platform 5.5: 05.55.45.2630<br>– Platform 5.6: 05.62.29.2630<br>– Platform 5.7: 05.72.21.2630<br>– Platform 6.0: 06.01.23.2630"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-12855","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-09T15:54:34.074995Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-09T20:51:33.091Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.kb.cert.org/vuls/id/553437"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-10-01T15:08:22.356Z"}}]}}}